GSM advanced system technique

EXERCISES 1 (199)
Uppgjord (även faktaansvarig om annan) - Prepared (also subject responsible if other) Nr - No.
KI/ERA/GD/UX Iwona Maksymowicz 038 14 - LZU 123 3333 Uen
Dokansv/Godk - Doc respons/Approved Kontr - Checked Datum - Date Rev File
KI/ERA/GD/UXC 07/01/00 H 03814.doc
GSM ADVANCED SYSTEM TECHNIQUE
LIST OF EXERCISES
EXERCISE 1 3
CHANNEL CONCEPT 3
EXERCISE 2 5
TRAFFIC CASES, GROUP EXERCISE 5
EXERCISE 3 7
PAGING GROUP 7
EXERCISE 4 9
TEMS EXERCISE 9
EXTRA EXERCISE (IF TIME ALLOWS) 15
EXERCISE 5 25
DECODING OF AN ABIS MESSAGE 25
EXERCISE 6 31
DECODING OF THE MSU 31
EXERCISE 7 37
ABIS, PROTOCOL ANALYZER 37
PRINTOUT OF LOG FILE 41
EXERCISE 8 53
A INTERFACE, PROTOCOL ANALYZER 53
EXERCISE 9 65
NETWORK SERVICE PART (NSP) 65
EXERCISE 10 87
SCCP USER INFORMATION 87

EXERCISES 2 (199)
EXTRACT FROM GSM 05.02 111

EXERCISES 3 (199)
EXERCISE 1
Channel Concept
1. How many logical channels are defined in GSM?
_________________________________________________
_________________________________________________
2. How many control channels are there?
_________________________________________________
3. Name at least three of the control channels.
_________________________________________________
4. What is a burst?
_________________________________________________
5. Why is the access burst special?
_________________________________________________

EXERCISES 4 (199)
6. What physical channels (frequency/timeslot) are the following
logical channels mapped upon in our example?
A. SDCCH
B. SCH
C. SACCH________________________________________
7. A handover must be performed during a call. What logical channel
is used for the Handover Command message?
_________________________________________________
_________________________________________________
_________________________________________________
8. Why is the 26th TDMA frame idle in a TCH multiframe?
_________________________________________________
_________________________________________________
_________________________________________________
9. How many traffic channels are there in a cell with our setup if
there are:
one carrier? _______________________________________
two carriers?_______________________________________
10. A mobile is idle, tuned to the BCCH channel. The subscriber
wants to make a call. Name the logical channels used during call
setup.
_________________________________________________
_________________________________________________
_________________________________________________

EXERCISES 5 (199)
EXERCISE 2
Traffic Cases, Group Exercise
Describe the signaling procedure for the following traffic cases:
A. International location updating
A mobile with an English subscription is switched on in
Spain. Describe the signaling.
B. International mobile to mobile call
A German mobile in Spain calls a Swedish mobile in
Germany. Describe between what network entities the
signaling is going.
C. Mobile to mobile SMS
Describe briefly the transfer of an SMS between two
MSs.
D. International inter MSC handover
A Swedish mobile crosses the border to Norway.
Describe a handover from a Swedish MSC to a
Norwegian MSC.

EXERCISES 6 (199)
ll aa nn
kk
BB
iioonnaa
llllyy
ttnnee
ttnnII

EXERCISES 7 (199)
EXERCISE 3
Paging Group
1. Find out how the paging group for a general mobile is determined,
use the GSM recommendations 05.02.
____________________________________________________
____________________________________________________
____________________________________________________
2. Use the rule from question 1 to determine the paging group for the
mobile described below.
IMSI = 2400100061162
MSISDN = 46705902149
Access class = 8
Control channels : SDCCH/8, one CCCH
BS_AG_BLKS_RES = 0
BS_PA_ MFRMS = 5
____________________________________________________
____________________________________________________
3. On what frequency (c0 - cn) and what timeslot are SDCCH/8 and
SACCH/C8 allowed?
____________________________________________________
4. On what frequencies and what timeslots are PCH and RACH
allowed?
____________________________________________________

EXERCISES 8 (199)
5. On SCH reduced TDMA frame number is used. This is described
in GSM recommendation 05.02. In what way does this number
differ from the normal TDMA frame number? (Additional help can
be found in GSM recommendation 05.10).
____________________________________________________
____________________________________________________

EXERCISES 9 (199)
EXERCISE 4
TEMS Exercise
• Choose “Log”, and then “Replay logfile”, see figure 1 below
(figure 1)
• Choose the file that contains a location update. Figure 2 shows an example.
(figure 2)
• A window like the one below turns up.
(figure 3)

EXERCISES 10 (199)
• Choose “Monitor”, and then “Layer 3 messages”, see figure 4 below
(figure 4)
Location updating
• In the window “Replay log control” press “Go to”. In the window as figure 5 shows, select “Go to
Message” and then select “CHANNEL RELEASE” and then press “OK”.
(figure 5)
• Enlarge your window “Layer 3 message” so you can see from CHANNEL REQUEST up to
CHANNEL RELEASE.
• To be able to see the details of a Layer 3 message, click on it as figure 6 is showing.
This CHANNEL REQUEST
is then showed in detail to the right
(figure 6)

EXERCISES 11 (199)
1. The message CHANNEL REQUEST is sent on the RACH. The message consists of two parts;
establishment cause and random reference.
What is the value of the random reference?
2. In the message IMMEDIATE ASSIGNMENT sent on AGCH, the MS is told which logical channels to
use throughout the location updating. Describe these logical channels.
a) Logical Channels:
b) Timeslot: c) Sub channel number:
3. Look at the message ”LOCATION UPDATING REQUEST”.
a) What type of Location updating is this? IMSI attach, normal or periodic registration.
b) What identity is the mobile using, IMSI/TMSI?
c) The old LAI (MCC+MNC+LAC) is sent. Give this old LAI which has been written on the SIM card.
4. Complete the example below, so it reflects this location updating.
Do NOT include any of the following messages: SYSTEM INFORMATION 5-6, MEASUREMENT
REPORT and SYNCH CHANNEL INFORMATION
MS Network (Logical Channel used, NOT shown by TEMS)
UL: CHANNEL REQUEST (RACH)
------------------------->
DL: IMMEDIATE ASSIGNMENT (AGCH)
<-------------------------
UL: LOCATION UPDATING REQUEST (Answer in 2a: )
------------------------->
DL: LOCATION UPDATING ACCEPT (--“--)
<-------------------------
DL: CHANNEL RELEASE (--“--)
<-------------------------

EXERCISES 12 (199)
5. If authentication is used, then what value has RAND and SRES, respectively?
a) RAND:
b) SRES:
6. If ciphering is used, then which algorithm is used?
7. Look at the message: LOCATION UPDATING ACCEPT. What LAI is being sent to the MS in this
message?
8. Compare the LAI in question 7 with the LAI in question 3c. Are these answers supporting your
answer in question 3a?
9. Use the SYSTEM INFORMATION messages just before the CHANNEL REQUEST message. The
MS reads this before trying to make a Location updating.
a) Which country and operator (MCC+MNC) does this cell belong to? (See table)
b) What is the LAI? Compare this LAI with the answer on question 7.
c) Which neighboring frequencies is the MS measuring on in ”Idle mode”? These frequencies
(ARFCN Absolute Radio Frequency Channel Number) are called neighboring BCCH-frequencies.

EXERCISES 13 (199)
LAYER 2 (LAPDm)
The same traffic case will be studied from Layer 2 point of view. Use the book as help (Ch. Um
interface, signaling layer 2).
• Choose in the menu “Monitor”, “Layer 2 Messages” (see figure 4)
• Press “Restart” in the “Log replay control”-window.
• Go To CHANNEL REQUEST. Press the STEP-button in the window “Replay log control” until
CHANNEL RELEASE and a few more messages are visible in the window “Layer 3 messages”.
• Make sure what you see in the window “Layer 2 message” starts by SABM-CMD & UA-RSP and
ends with DISC-CMD & UA-RSP. It will look similar to figure 7.
(figure 7)
10. Click on the first ”I-CMD message”, what Layer 3 message is this Layer 2 message carrying?
11. Compare the size of the “message dump” for this Layer 2 message and the corresponding Layer 3
message. They differ by 3 octets; Length Indicator, Address and Control Field.
N(S) and N(R) are two parts of the Control Field. Study how they change during this location
updating.
What is the purpose of N(S) and N(R)?
Close this file.
CMD Command
DISC DISConnect
(terminates Acknowledge Mode)
I Information
RSP Response
SABM Set Asynchronous Balanced Mode
(starts Acknowledge Mode)
UA Unnumbered Acknowledge

EXERCISES 14 (199)
CALL
A call will be studied.
• Replay the file that contains a call
• Monitor Layer 3 messages only (see figure 4).
• Go to the message ASSIGNMENT COMMAND (see figure 5).
12. Answer with help of the figures in the chapter ”Traffic cases”. Is this call a “Mobile Terminated” call
or a “Mobile Originated” call?
13. What is the difference between the messages/procedures in the book and in this call set-up?
14. If this is a Mobile Terminated call answer this question. Find the PAGING REQUEST that contains
this MS. Is IMSI/TMSI used? What value is it?
15. Give the telephone number the other party has. This is written in the SETUP message
16. Find out the following about the TCH described in the message ASSIGNMENT COMMAND
Frequency hopping: YES/NO
Frequency/frequencies:
Timeslot:
Training Sequence Code:
• Close this file

EXERCISES 15 (199)
Extra Exercise (if time allows)
Handover
• Replay the file that contains a handover.
• Monitor Layer 3 Messages (see figure 4)
• Choose the menu “Monitor”, then under “Status information” select “Graphical presentation”.
The grey color is the serving cell Different colors mean neighboring cells
Light grey = IDLE mode
Dark grey = BUSY mode
This vertical line indicates By clicking in the window you see
a handover. information about that moment in the
lower part of this window
• Go to a HANDOVER COMMAND in the file (see figure 5).
17. Which frequency was (frequencies were) used after the handover?
18. What is the first message in the new cell?
19. Give the value of the handover reference value.
20. What is the Timing Advance value in the new cell?

EXERCISES 16 (199)
Measurements
Look at a MEASUREMENT REPORT.
21. How many neighbors can a report contain?
22. How many neighbors are reported in the one you are looking at?
23. How many MEASUREMENT REPORTS are sent each second?
24. Now and then SYNCH CHANNEL INFORMATION is read from the neighboring cells. Why?
• Close the file and exit the program.

EXERCISES 17 (199)
Some GSM mobile operators MCC+MNC
Country Operator name Network code
------ ------------- ------------
Albania AMC 276 01
Andorra STA-Mobiland 213 03
Armenia Armentel 283 01
Australia Optus 505 02
Telecom/Telstra 505 01
Vodafone 505 03
Austria Mobilkom Austria 232 01
max.mobil. 232 03
Connect Austria 232 05
Azerbaidjan Azercell 400 01
JV Bakcell 400 02
Bahrain Batelco 426 01
Bangladesh Grameen Phone Ltd. 470 01
TM International 470 19
Sheba Telecom
Belgium Proximus 206 01
Mobistar 206 10
KPN Orange 206 20
Bosnia Cronet 218 01
PTT Bosnia 218 19
Botswana Mascom Wireless 652 01
Brunei DSTCom 528 11
Jabatan Telekom 528 01
Bulgaria MobilTel AD 284 01
Burkina Faso OnaTel
Cambodia CamGSM 456 01
Cambodia Samart 456 02
Cambodia Shinawatra
Cape Verde Cabo Verde Telecom 625 01
Cameroon PTT Cameroon Cellnet 624 01
Cape Verde Cabo Verde Telecom
Canada Microcell 302 37
Chile Entel Telefonia
China Guangdong MCC 460 00
Beijing Wireless
China Unicom 460 01
Zhuhai Comms
DGT MPT
Jiaxing PTT
Tjianjin Toll
Liaoning PPTA 460 02
Congo African Telecoms
Congolaise Wireless

EXERCISES 18 (199)
Croatia HR Cronet 219 01
Vipnet 219 10
Cyprus CYTA 280 01
Czech Rep. Eurotel Praha 230 02
Radio Mobil 230 01
Denmark Sonofon 238 02
Tele Danmark Mobil 238 01
Mobilix 238 30
Telia 238 20
Egypt MobiNil 602 01
Click GSM 602 02
Estonia EMT 248 01
Radiolinja Eesti 248 02
Q GSM 248 03
Ethiopia ETA 636 01
Faroe Isl. Faroese Telecom
Fiji Vodafone 542 01
Finland Radiolinja 244 05
Sonera 244 91
Alands Mobiltelefon 244 05
Telia 244 03
Finnet 244 09
Lännen Puhelin 244 09
Helsingin Puhelin 244 09
France France Telecom 208 01
SFR 208 10
Bouygues Telekom 208 20
Fr.Polynesia Tikiphone 547 20
Fr.W.Indies Ameris 340 01
Georgia Superphone
Geocell 282 01
Magticom 282 02
Germany D1, DeTeMobil 262 01
D2, Mannesmann 262 02
E-Plus Mobilfunk 262 03
Viag Interkom 262 07
Ghana Franci Walker Ltd.
ScanCom 620 01
Gibraltar GibTel 266 01
G Britain Cellnet 234 10
Vodafone 234 15
Jersey Telecom 234 50
Guernsey Telecom 234 55
Manx Telecom 234 58
One2One 234 30
Orange 234 33

EXERCISES 19 (199)
Greece Panafon 202 05
STET 202 10
Cosmote 202 01
Greenland Tele Greenland
Guinea Int’l Wireless 611
Spacetel 611
Sotelgui 611 02
Hong Kong HK Hutchison 454 04
SmarTone 454 06
Telecom CSL 454 00
P Plus Comm 454 22
New World PCS 454 10
Mandarin Comm 454 16
Pacific Link 454 18
Peoples Telephone 454 12
SMC PCS 454 22
Hungary Pannon GSM 216 01
Westel 900 216 30
Iceland Post & Simi 274 01
Icelandic Mobile Phone 274 02
India Airtel 404 10
Essar 404 11
Maxtouch 404 20
BPL Mobile 404 21
Command 404 30
Mobilenet 404 31
Skycell 404 40
RPG MAA 404 41
Modi Telstra 404 14
Sterling Cellular 404 11
Mobile Telecom
Airtouch
BPL USWest 404 27
Koshika
Bharti Telenet
Birla Comm
Cellular Comms
TATA 404 07
Escotel 404 12
JT Mobiles
Evergrowth Telecom
Aircel Digilink 404 15
Hexacom India
Reliance Telecom
Fascel Limited

EXERCISES 20 (199)
Indonesia TELKOMSEL 510 10
PT Satelit Palapa 510 01
Excelcom 510 11
PT Indosat
Iraq Iraq Telecom 418
Iran T.C.I. 432 11
Celcom
Kish Free Zone
Ireland Eircell 272 01
Digifone 272 02
Meteor 272 03
Israel Partner Communications 425 01
Italy Omnitel 222 10
Telecom Italia Mobile 222 01
Wind 222 88
Ivory Coast Ivoiris 612 03
Telecel 612
Comstar 612 01
Loteny Telecom 612 05
Jordan JMTS 416 01
Kenya Kenya Telecom
Kuwait MTCNet 419 02
Kyrgyz Rep Bitel Ltd. 437 01
La Reunion SRR 647 10
Laos Lao Shinawatra 457 01
Latvia LMT 247 01
BALTCOM GSM 247 02
Lebanon Libancell 415 03
Cellis 415 01
Lesotho Vodacom 651 01
Liechtenstein Natel-D 228 01
Lithuania Omnitel 246 01
Bite GSM 246 02
Luxembourg P&T LUXGSM 270 01
Millicom Lux’ S.A 270 77
Lybia Orbit
El Madar
Macao CTM 455 01
Macedonia PTT Makedonija 294 01
Madagascar Sacel 646 03
Madacom 646 01
SMM 646 02
Malawi TNL 650 01
Malaysia Celcom 502 19
Maxis 502 12
TM Touch 502 13
Adam 502 17
Digi Telecom 502 16

EXERCISES 21 (199)
Malta Advanced 278
Telecell 278 01
Marocco O.N.P.T. 604 01
Mauritius Cellplus 617 01
Moldova Voxtel
Monaco France Telecom 208 01
SFR 208 10
Office des Telephones
Mongolia MobiCom
Montenegro Pro Monte 220 02
Mozambique Telecom de Mocambique 634 01
T.D.M GSM1800
Namibia MTC 649 01
Netherlands PTT Netherlands 204 08
Libertel 204 04
Telfort Holding NV 204 12
Ben 204 16
Dutchtone 204 20
New Caledonia Mobilis 546 01
New Zealand Bell South 530 01
Nigeria EMIS
Norway NetCom 242 02
TeleNor Mobil 242 01
Oman General Telecoms 422 02
Palestinia Palestine Telecoms
Pakistan Mobilink 410 01
Papua Pacific 310 01
Philippines Globe Telecom 515 02
Islacom 515 01
Smart 515 03
Poland Plus GSM 260 01
ERA GSM 260 02
IDEA Centertel 260 03
Portugal Telecel 268 01
TMN 268 06
Main Road Telecoms
Optimus 268 03
Qatar Q-Net 427 01
Romania MobiFon 226 01
MobilRom 226 10

EXERCISES 22 (199)
Russia Mobile Tele... Moscow 250 01
United Telecom Moscow
NW GSM, St. Petersburg 250 02
Dontelekom 250 10
KB Impuls 250 99
JSC Siberian Cellular 250
BM Telecom 250 07
Beeline 250
Extel 250 28
Far Eastern Cell 250 12
San Marino Omnitel 222 10
Wind 222 88
SaudiArabia Al Jawal 420 01
EAE 420 07
Senegal Sonatel 608 01
Seychelles SEZ SEYCEL 633 01
Airtel 633 10
Serbia Serbian PTT 220 03
Singapore Singapore Telecom 525 01
MobileOne 525 03
Binariang
Slovak Rep Eurotel 231 02
Globtel 231 01
Slovenia Mobitel 293 41
SI.Mobil
South Africa MTN 655 10
Vodacom 655 01
Sri Lanka MTN Networks Pvt Ltd. 413 02
Spain Airtel 214 01
Telefonica Spain 214 07
Amena 214 03
Sudan Mobitel 634 01
Sweden Comviq 240 07
Europolitan 240 08
Telia Mobile 240 01
Switzerland Swisscom 900 228 01
Swisscom 1800 228 01
diAx mobile 228 02
Orange
Syria SYR MOBILE 417 09

EXERCISES 23 (199)
Taiwan LDTA 466 92
Mobitai 466 93
TransAsia 466 99
TWN 466 97
Tuntex 466 06
KG Telecom 466 88
FarEasTone 466 01
Chunghwa 466 11
Tanzania Tritel 640 01
Thailand TH AIS GSM 520 01
Total Access Comms 520 18
WCS 520 10
Hello 520 23
Tunisia Tunisian PTT 605 02
Turkey Telsim 286 02
Turkcell 286 01
UAE UAE ETISALAT-G1 424 01
UAE ETISALAT-G2 424 02
Uganda Celtel Cellular 641 01
MTN 641 10
Ukraine Mobile comms 255 01
Golden Telecom 255 05
Radio Systems 255 02
Kyivstar JSC 255 03
USA Bell South 310 15
Sprint Spectrum 310 02
Voice Stream 310 26
Aerial Comms. 310 31
Omnipoint 310 16
Powertel 310 27
Wireless 2000 310 11
Uzbekistan Daewoo GSM 434 04
Coscom 434 05
Buztel 434 01
Vatican Omnitel 222 10
Wind 222 88
Venezuela Infonet 734 01
Digitel
Vietnam MTSC 452 01
DGPT 452 02
Yugoslavia Mobile Telekom 220 01
Promonte 220 02
Telekom Serbia 220 03
Zaire African Telecom Net
Zimbabwe NET*ONE 648 01
Telecel Zimbabwe 648 04

EXERCISES 24 (199)
ll aa nn
kk
BB
iioonnaa
llllyy
ttnnee
ttnnII

EXERCISES 25 (199)
EXERCISE 5
Decoding of an Abis Message
EXAMPLE
The following message is sent on Abis in the uplink direction. Hexadecimal
notation is used.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
• Use the figure describing the LAPD frame format in Abis chapter in the
AST book. On the Abis bus log neither the flags nor the FCS are shown.
• Try to decode the message using GSM recommendations 08.58 and
04.08.
Solution
First look at the figure in Abis chapter of the AST book where we find the
structure of a LAPD frame.
The address and control fields are LAPD functions and are not described in
the GSM specifications. LAPD functions are specified in CEPT T/S 46-20 (not
included in this booklet). Only the contents in the information field are
described in GSM TS 08.58.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
address: hex 0 0 0 1
bin 0000 0000 0000 0001
SAPI C/R EA TEI EA
SAPI=0 ⇒
RSL message
command
(uplink)
more
octets in
address
TEI=0
HW address of
TRX
last
octet in
address

EXERCISES 26 (199)
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
control field: hex 3 E 6 2
bin 0011 1110 0110 0010
N(S) 0 N(R) P/F
send seq.No.
31
fixed
0
receive seq.No.
49
poll/final
0
Start to check in 08.58, section 8 (Message formats) what a message looks
like in general.
All messages start with a message discriminator.
See 08.58 ( sections 9 and 9.1) for Information element coding and message
discriminator.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
message discr.: hex 0 C
bin 0000 1100
Message discriminator: By looking in 9.1 we see that this is a message in the
common channel management message group. First bit to the right indicates
if this message is transparent or not for BTS. T = 0 in this case, which means
that it is a non-transparent message.
Now we know it is a common channel management message.

EXERCISES 27 (199)
Look up the format in 08.58, section 8.5
Information element reference type length
Message discriminator 9.1 M 1
Message type 9.2 M 1
Channel number 9.3.1 M 2
Information elements
depending on message
type
We see that the next octet gives us the message type.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
message type: hex 1 3
bin 0001 0011
Message type is described in 9.2.
We find that this means channel required. There is a reference to 8.5.3.
8.5.3 CHANNEL REQUIRED
Information element reference type length
Message discriminator 9.1 M 1
Message type 9.2 M 1
Channel number 9.3.1 M 2
Request Reference 9.3.19 M 4
Access Delay 9.3.17 M 2
Physical Context 9.3.16 O V

EXERCISES 28 (199)
We see that the next 2 octets describe the channel number.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
channel No.: hex 0 1 8 8
bin 0000 0001 1000 1000
We look in the given reference 9.3.1, where we see what these 2 octets
consist of.
The first octet is the element identifier (check 9.3) telling us that the next octet
contains the channel number. In 9.3.1 we see that this is uplink CCCH
(RACH) and that timeslot 0 is used.
Go to 8.5.3 again. Next 4 octets contain Request reference.
Go to 9.3.19.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
First octet can be decoded by looking in 9.3.
hex 1 3
bin 0001 0011 ⇒ Element identifier = Request reference
Next octet gives us the Random Access information, which is described in
GSM TS 04.08, section 9.1.8.
8 7 6 5 4 3 2 1
Establishment cause Random reference
hex E 4
bin 1110 0100
Establish cause = originating call (while this is taken from a MO call)

EXERCISES 29 (199)
Random reference: a value between 0 and 31 which here equals 4.
Next two octets (06 42) indicate in which TDMA frame number the request
was received at the BTS. 0000 0110 0100 0010. Note: this is not the
complete frame number but FN MOD 42432 meaning only 16 bits are used.
There are 2 octets left. Go back to 8.5.3.
00 01 3E 62 0C 13 01 88 13 E4 06 42 11 01
As we know from looking in 8.5.3, these 2 octets describe the access delay.
Go to 9.3.17
Check in 9.3 that the element identifier is what we expect
hex 1 1 0 1
bin 0001 0001 0000 0001
Last octet contains the access delay and there is one bit access delay.
As we see in 8.5.3 there is a possibility to send an optional parameter. This
parameter is not used here.
Exercise
The message below is sent on the Abis interface in the downlink direction.
The message is described using the hexadecimal code.
Decode the message using GSM recommendations 08.58 and 04.08.
Flags and LAPD checksum are not included.
02 01 04 B8 08 26 01 51 07 01 01 02 00 0B 00 03 06 35 00

EXERCISES 30 (199)
ll aa nn
kk
BB
iioonnaa
llllyy
ttnnee
ttnnII

EXERCISES 31 (199)
EXERCISE 6
Decoding of the MSU
MAP is the protocol used between exchanges in GSM. MAP uses TCAP,
SCCP and MTP to send information.
TCAP encodes, packs and sends the information received from MAP. SCCP
is used for analysis and addressing. MTP receives the information from
SCCP, adds information for error detection and correction and puts the data
in specified fields. This forms a message signal unit (MSU) which is sent by
the signaling terminal to the receiving exchange.
In this exercise you shall decode a message sent between two exchanges in
the GSM service area. You find each field described on the pages following
the exercise. The last page shows how TCAP packs the information, forming
constructors out of elements.
• Concentrate on the SIO and SIF fields.
• Between what GSM nodes is this message sent?
• Where do you find the information about which MAP operation it is?

EXERCISES 32 (199)
01001000100001 0000 0011 LI F FSN B BSN 0111 1110
DPC SIO FL
010010100001011000 0000 00000000 1001
Len
9 21 12 3
Pointer
data
Pointer
calling
Pointer
called
Protocol
class
Message
type SLS OPC
0000 0100 0001 001021 80 44
Called
Address
Nature
of address
Numb plan
+ Encoding
Transl.
type SSN
0000 0000 0000 0110 0001 0010
Address
type
0000 0100 0001 001046 9 23
Nature
of address
Numb plan
+ Encoding
Transl.
type SSN
0000 0000 0000 0111 0001 0010
Address
type Length
0000 0100 0100 10001 30 70
ID
length
0110 0010
Total
length Calling Address
5234
ID
Transaction
ID (Orig.)
Tag
(Begin)
0000 0010 0000 0110 1 23 25
Operation
code tag
Invoke
ID
0000 0010 1010 0001 0110 1100
Comp.
length
Invoke
ID length
Invoke
ID Tag
Comp.
type tag
(invoke)
Comp.
p. length
Comp.
p. tag
82341 09 115 0011 0000
IMSI
1000 0000
Length Tag = 0 Length Tag
Sequence Operation
code
Op. code
Length
789F3 00560011 0000
Length IMSI
Tag = 16
Sequence
34 12
0111 1110 0000 0001CK 1 0000 1010
Request Param.
AuthenticationFlag
Tag = 10
EnumeratedLength

EXERCISES 33 (199)
FL CK SIF SIO LI F FSN B BSN FL
FL Flag
CK Check sum
SIF Signaling Information Field
SIO Service Information Octet
LI Length Indicator
F Forward Indicator Bit
FSN Forward Sequence Number
B Backward Indicator Bit
BSN Backward Sequence Number
SSF SI
SSF Sub service Field
SI Service Indicator
SI
0000 Signaling Network Management
0001 Signaling Network Testing and
Maintenance Message
0010 Spare
0011 SCCP
0100 TUP
0101 ISUP
0110 DUP
0111 DUP
SSF
00xx International Network
01xx Spare (for International Use)
10xx National Network
11xx Reserved for National Use
xx Spare for International Use
xx Application Dependent in National Use
4 4
8 16 8n, n>1 8 2 6 1 7 1 7 8
Optional
Part
Message Type
0000 0001 CR Connection Request
0000 0010 CC Connection Confirm
0000 0011 CREF Connection Refusal
0000 0100 RLSD Released
0000 0101 RLC Release Complete
0000 0110 DT1 Data Form 1
0000 1001 UDT Unit Data
0001 0000 IT Interactivity Test
FL CK SIF SIO LI F FSN B BSN FL
8 16 8n, n>1 8 2 6 1 7 1 7 8
Mandatory Variable
Part
Mandatory Fixed
Part
Message
Type
Routing
Label
SCCP
8 8 32
SLS OPC DPC
DPC Destination Point Code
OPC Originating Point Code
SLS Signaling Link Select
SLC Signaling Link Code
SLS = SLC in a TUP message

EXERCISES 34 (199)
Optional
Part
Protocol Class
Mandatory Variable
Part
Mandatory Fixed
Part
Message
Type
Routing
Label
8 8 32
0000 Class 0 CL
0001 Class 1 CL
0010 Class 2 CO
0011 Class 3 CO
0100 Class 4 CO
bit 8765 are spare at Connection Oriented
bit 8765 are coded for connection Less
0000 No special option
1000 Return message on error
0xxx Spare
Data
Calling Party
Address
Called Party
Address
Pointer
data
Pointer
calling
Pointer
called
The pointer value gives the number of octets
between the pointer itself (Included) and the first
octet (Not included) of the parameter associated
with that pointer.
Address
Address
Type
Length
8 8
Length = Number of octets
Address Type
000x 00x1 SPC included
000x 001x SSN included
0001 00xx GT included

EXERCISES 35 (199)
Data
Calling Party
Address
Called Party
Address
Pointer
data
Pointer
calling
Pointer
called
Address
Address
Type
Length
8 8
See next
page
1st two digits
of address
Nature of
Address
Numb.
Plan
Encod
Scheme
8 8 4 4 8
Trans.
Type
SSN
88
ENCODING SCHEME
0001 BCD odd Number
0010 BCD even Number
NATURE OF ADDRESS
0000 0001 Subscriber
0000 0011 National
0000 0100 International
Subsystem number, SSN
0000 0110 MAP-HLR
0000 0111 MAP-VLR
TRANSLATION TYPE
usually coded as
0000 0000 for GSM
NUMBERING PLAN
0001 = E.164
0111 = E.214
CALLING PARTY ADDRESS
Coded as called part address
DATA
See next page
Last two digits
of address

EXERCISES 36 (199)
COMPONENT PORTION TAG
COMPONENT PORTION LENGTH
COMPONENT TYPE TAG (INVOKE)
COMPONENT LENGTH
INVOKE ID TAG
INVOKE ID LENGTH
INVOKE ID
OPERATION CODE TAG
OPERATION CODE LENGTH
9 (=send parameters)
SEQUENCE TAG
SEQUENCE LENGTH
TAG = 0 (IMSI)
LENGTH
IMSI
SEQUENCE TAG
LENGTH
TAG=10 (ENUMERATED)
LENGTH
1 (=req auth set)
TRANSACTION PORTION INFO ELEMENT
(TAG, LENGTH, ID)
MESSAGE TYPE TAG (BEGIN))
TOTAL MESSAGE LENGTH)

EXERCISES 37 (199)
EXERCISE 7
Abis, Protocol Analyzer
During this exercise you will study signaling on Abis, recorded in a logfile
called motabis.msu.
To start the exercise, follow the instruction below (1 - 9):
1. Choose: “MPA Eventlog browser” in the program group “GN Nettest
MPA”.
2. Go to: “File”, “Open”.
3. Choose: motabis.msu.
4. To the right of the “format”-button, there is a window displaying:
• “overview- one line”.
Press the arrow pointing downwards and choose:
• “detailed- all fields with hex”.
5. Press the “format”- button. In the “Decode params”-folder, choose
“relative” in the Time option box. Then go to the “Protocol layers” folder.
6. Choose “ETSI GSM Abis” in the window to the right of “Protocols, in use ”
Make sure there is an “x” in all the white boxes. That is, in: “LAPD”,
“L2Mngt”, “Network Mngt”,“Traffic Mngt”, “DTAP” and “SS”.
7. Go to the “link colors”- folder.
8. “LU2 TLink1A SLink2” is Abis uplink, lets have it in red!
“LU2 TLink1B SLink2” is Abis downlink, make it blue!
To color each entire message use the “Apply Color” box.
Click OK!

EXERCISES 38 (199)
9. In the colored header of each frame there is a number for each frame.
The first frame in the logfile has No. 1.441.
Below the header, the frame content is shown. There are three columns:
• In the left column the octets are displayed in hex.
• The middle column shows the names of the information fields in the
octet. Double-click on the name for more info. Then exit
• The right column shows the decoding of the information fields.
Your traffic case starts in frame 29.175 and stops in frame 39.979. Try to
answer the questions on the following pages. Where applicable make a note
of where in the logfile you found the answer.
1. Is the message in frame No. 29.175 sent uplink or downlink?
2. Look at the L2 header (address and control field):
A. What logical link carries this message?
B. Is it a command or response?
C. To which TRX is the message sent?
D. What are the values of the sequence counters?
3. To what group of traffic management messages does this
message belong?
4. In that group, what is the Abis message?
5. On what channel is the message sent over the air?

EXERCISES 39 (199)
6. What paging group does the searched MS belong to?
7. Is the MS close to or far away from the BTS (see frame 30.122)?
Look at the following frames:
8. What downlink Abis message is sent in frame 30.131?
9. Describe the air channel handled in that message:
A. channel combination and sub-channel number
B. timeslot number
C. is frequency hopping used?
D. what about DTX uplink and downlink?
E. what TA value will the MS use (compare to access delay)?
10. In frame No. 30.153 the analyzer fails to decode the layer 3
information.
A. What is the problem?
B. What Abis message is it?

EXERCISES 40 (199)
11. Look at frame 30.442.
A. What Abis message is there?
B. This message carries layer 3 information from the air
interface. What identity is MS using to identify itself?
C. What is the maximum output power of the MS?
D. Which is the home network of this subscriber?
12. Will encryption be used?
13. What happens in frame 30.947?
14. Is the “Assignment command” message handled transparently or
non-transparently by the BTS?
15. Which frequency and timeslot will be used by the TCH?
16. What happens in frames 31.768 and 31.778?
When the call is over:
17. Who initiates call clearing, the A or the B subscriber?

EXERCISES 41 (199)
Printout of Log file
LU2 TLink1B SLink2 29.175
Error: PDU is longer than expected
=== LAPD ===
--- ADDRESS ---
02 SAPI : 0 = Radio Signaling
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
FA N(S) : 125
IFORMAT : .......0
B2 N(R) : 89
P : .......0
--- INFO ---
=== TRAF MGMT ===
0C MESS DISCR : 06h = Common Channel Management
T-Bit : .......0 = Non-Transparent
15 ExtBit : 0.......
MESS TYPE : 15h = Paging Command
--- PAGE CMD ---
01 IE ID : 01h
--- CHANNEL NO ---
90 CHANNEL : 10010... = Downlink CCCH (PCH + AGCH)
TIMESLOT : 0
0E IE ID : 0Eh
--- PAGE GROUP ---
03 PAGE GROUP : 3
0C IE ID : 0Ch
--- MS IDENT ---
--- MOBILE ID ---
08 LEN : 8
29 TYPE : 1 = IMSI
ODD/EVEN : ....1... = Odd
26 20 04 88
09 01 30 IDENTITY : 262024088901003
28 02 BYTE DUMP : 28 02h

EXERCISES 42 (199)
LU2 TLink1A SLink2 30.122
=== LAPD ===
--- ADDRESS ---
CR : ......0.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
B2 N(S) : 89
IFORMAT : .......0
FC N(R) : 126
P : .......0
--- INFO ---
=== TRAF MGMT ===
13 ExtBit : 0.......
MESS TYPE : 13h = Channel Required
--- CHAN RQD ---
01 IE ID : 01h
--- CHANNEL NO ---
88 CHANNEL : 10001... = Uplink CCCH (RACH)
TIMESLOT : 0
13 IE ID : 13h
--- REQ REF ---
92 RA : 92h
F2 N32 : 30
95 N51 : 20
N26 : 21
11 IE ID : 11h
--- ACC DELAY ---
01 ACC DELAY : 1

EXERCISES 43 (199)
______________________________________________________________________________
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
FC N(S) : 126
IFORMAT : .......0
B4 N(R) : 90
P : .......0
--- INFO ---
=== TRAF MGMT ===
08 MESS DISCR : 04h = Dedicated Channel Management
21 ExtBit : 0.......
MESS TYPE : 21h = Channel Activation
--- CHAN ACTIV ---
01 IE ID : 01h
--- CHANNEL NO ---
6A CHANNEL : 01101... = SDCCH/8 + ACCH, subch. 5
TIMESLOT : 2
03 IE ID : 03h
--- ACTIV TYPE ---
00 RESERVED : 00h
ACTIV TYPE : 0 = Immediate assignment procedure
06 IE ID : 06h
04 LEN : 4
--- CHAN MODE ---
00 RESERVED : 0
DTXd : ......0.
DTXu : .......0
--- CHAN TYPE ---
03 SPCH/DATA : 03h = Signaling
01 CHAN RATE : 1 = SDDCH
00 SPEECH ENC : 0 = No Resources Required
05 IE ID : 05h
06 LEN : 6
--- CHANNEL ID ---
--- CHAN DESCR ---
64 IE ID : 64h
6A CHAN TYPE : 01101... = SDCCH/8 + ACCH, subch. 5
TIMESLOT : 2
80 TRAIN SEQ : 100.....
H : ...0.... = Single RF Channel
SPARE : ....00..
FREQ BAND : 0
1D SPARE : 0.......
ARFCN : 29
--- MOBILE ALL ---
72 IE ID : 72h
00 LEN : 0
0D IE ID : 0Dh
--- MS POWER ---
05 RESERVED : 0
MS PWR LEV : 5
18 IE ID : 18h
--- TIMING ADV ---
01 RESERVED : 0h
TIMING ADV : 01h

EXERCISES 44 (199)
______________________________________________________________________________
Error: Unknown Message Type
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
FE N(S) : 127
IFORMAT : .......0
B6 N(R) : 91
P : .......0
--- INFO ---
=== TRAF MGMT ===
16 ExtBit : 0.......
MESS TYPE : 16h = Immediate Assign Command
--- IMM AS CMD ---
01 IE ID : 01h
--- CHANNEL NO ---
90 CHANNEL : 10010... = Downlink CCCH (PCH + AGCH)
TIMESLOT : 0
2B IE ID : 2Bh
17 LEN : 23
--- IMM AS INF ---
2D TIFLAG : 0h = Sent from TI originator
TIVAL : 2h
PDC : 13 = ???
06 ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 6 = ???
3F 03 6A 80 1D 92 F2 95 01 00 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B 2B
BYTE DUMP : 3F 03 6A 80 1D 92 F2 95 01 00 2B 2B 2B 2B 2B 2B 2B 2B
2B 2B 2Bh

EXERCISES 45 (199)
______________________________________________________________________________
=== LAPD ===
--- ADDRESS ---
CR : ......0.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
B6 N(S) : 91
IFORMAT : .......0
00 N(R) : 0
P : .......0
--- INFO ---
=== TRAF MGMT ===
02 MESS DISCR : 01h = Radio Link Layer Management
06 ExtBit : 0.......
MESS TYPE : 06h = Establish Indication
--- EST IND ---
01 IE ID : 01h
--- CHANNEL NO ---
TIMESLOT : 2
02 IE ID : 02h
--- LINK ID ---
00 CHAN TYPE : 0 = Main Signaling Channel
NA : ..0.....
RESERVED : 0h
SAPI : 0 = High Priority
0B IE ID : 0Bh
00 0F LEN : 15
--- L3-INFO ---
=== DTAP ===
06 TIFLAG : 0h = Sent from TI originator
TIVAL : 0h
PDC : 6 = Radio Resources
27 ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 27h = Paging Response
--- PAGINGRESP ---
--- CIPHER KEY ---
07 KEY SEQ : 7
SPARE : ....0...
SPARE : 0000....
--- MS CLASS 2 ---
02 LEN : 2
03 REV. LEVEL : 000.....
ENCRYPTION : ...00... = Algorithm A5
RF POWER : .....011 = Class 4, handheld
18 SPARE : 0001....
SM CAP : ....1... = SM capability present
FREQ CAP : .....000 = Band number 0
--- MOBILE ID ---
08 LEN : 8
29 TYPE : 1 = IMSI
26 20 04 88
09 01 30 IDENTITY : 262024088901003

EXERCISES 46 (199)
______________________________________________________________________________
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
00 N(S) : 0
IFORMAT : .......0
B8 N(R) : 92
P : .......0
--- INFO ---
=== TRAF MGMT ===
26 ExtBit : 0.......
MESS TYPE : 26h = Encryption Command
--- ENCR CMD ---
01 IE ID : 01h
--- CHANNEL NO ---
TIMESLOT : 2
07 IE ID : 07h
01 LEN : 1
--- ENCR INFO ---
01 ALGORITHM : 1 = No Encryption required
02 IE ID : 02h
--- LINK ID ---
NA : ..0.....
RESERVED : 0h
0B IE ID : 0Bh
00 03 LEN : 3
--- L3-INFO ---
=== DTAP ===
TIVAL : 0h
35 ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 35h = Ciphering Mode Command
--- CIPHMDECMD ---
--- CIPH MODE ---
00 SC : .......0 = DTX was not used
SPARE : ....000.
SPARE : 0000....

EXERCISES 47 (199)
______________________________________________________________________________
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
02 N(S) : 1
IFORMAT : .......0
BA N(R) : 93
P : .......0
--- INFO ---
=== TRAF MGMT ===
T-Bit : .......1 = Transparent
01 ExtBit : 0.......
MESS TYPE : 01h = Data Request
--- DATA REQ ---
01 IE ID : 01h
--- CHANNEL NO ---
TIMESLOT : 2
02 IE ID : 02h
--- LINK ID ---
00 CHAN TYPE : 0 = Main signaling Channel
NA : ..0.....
RESERVED : 0h
0B IE ID : 0Bh
00 03 LEN : 3
--- L3-INFO ---
=== DTAP ===
TIVAL : 0h
PDC : 5 = Mobility Management
18 ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 18h = Identity Request
--- IDENT REQ ---
--- IDENTITY ---
02 TYPE : .....010 = IMEI
SPARE : ....0...
SPARE : 0000....

EXERCISES 48 (199)
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
08 N(S) : 4
IFORMAT : .......0
C0 N(R) : 96
P : .......0
--- INFO ---
=== TRAF MGMT ===
T-Bit : .......1 = Transparent
01 ExtBit : 0.......
MESS TYPE : 01h = Data Request
--- DATA REQ ---
01 IE ID : 01h
--- CHANNEL NO ---
TIMESLOT : 2
02 IE ID : 02h
--- LINK ID ---
NA : ..0.....
RESERVED : 0h
0B IE ID : 0Bh
00 08 LEN : 8
--- L3-INFO ---
=== DTAP ===
TIVAL : 0h
2E ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 2Eh = Assignment Command
--- ASSIG CMD ---
--- CHAN DESCR ---
0C CHAN TYPE : 00001... = Bm + ACCH
TIMESLOT : 4
80 TRAIN SEQ : 100.....
H : ...0.... = Single RF Channel
SPARE : ....00..
FREQ BAND : 0
1D SPARE : 0.......
ARFCN : 29
--- POWERCMD ---
05 SPARE : 000.....
POWERLEVEL : 5
--- CHAN MODE ---
63 IE ID : 63h
01 MODE : 01h = Speech full rate

EXERCISES 49 (199)
________________________________________________________________________
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
0A N(S) : 5
IFORMAT : .......0
C4 N(R) : 98
P : .......0
--- INFO ---
=== TRAF MGMT ===
2E ExtBit : 0.......
MESS TYPE : 2Eh = RF Channel Release
--- RF CHN REL ---
01 IE ID : 01h
--- CHANNEL NO ---
TIMESLOT : 2
=== LAPD ===
--- ADDRESS ---
CR : ......1.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- S_FRAME ---
01 SPARE : 0
S : 0 = RR
SFORMAT : 1
0C N(R) : 6
P/F : .......0

EXERCISES 50 (199)
=== LAPD ===
--- ADDRESS ---
CR : ......0.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
C4 N(S) : 98
IFORMAT : .......0
0C N(R) : 6
P : .......0
--- INFO ---
=== TRAF MGMT ===
33 ExtBit : 0.......
MESS TYPE : 33h = RF Channel Release Acknowledge
--- RF CH RACK ---
01 IE ID : 01h
--- CHANNEL NO ---
TIMESLOT : 2

EXERCISES 51 (199)
LU2 TLink1A SLink2 35.964 SAPI: 0 TEI: 0 RR
LU2 TLink1A SLink2 36.146 SAPI: 0 TEI: 0 UI MEAS RES Bm + ACCH TIMESLOT: 4 Measurement
Report
Report
Report
Report
LU2 TLink1B SLink1 37.753 SAPI: 0 TEI: 1 RR
Report
LU2 TLink1A SLink2 38.383 SAPI: 0 TEI: 0 DATA IND Bm + ACCH TIMESLOT: 4 Disconnect CAUSE
VAL: 16
LU2 TLink1B SLink2 38.422 SAPI: 0 TEI: 0 DATA REQ Bm + ACCH TIMESLOT: 4 Release CAUSE
VAL: 16
Report
LU2 TLink1A SLink2 38.581 SAPI: 0 TEI: 0 DATA IND Bm + ACCH TIMESLOT: 4 Release Complete
LU2 TLink1B SLink2 38.621 SAPI: 0 TEI: 0 DATA REQ Bm + ACCH TIMESLOT: 4 Channel Release
Normal Release
LU2 TLink1B SLink2 38.622 SAPI: 0 TEI: 0 DACT SACCH Bm + ACCH TIMESLOT: 4
LU2 TLink1A SLink2 38.761 SAPI: 0 TEI: 0 EST IND Bm + ACCH TIMESLOT: 4
Report
LU2 TLink1A SLink2 39.503 SAPI: 0 TEI: 0 UI MEAS RES Bm + ACCH TIMESLOT: 4
LU2 TLink1B SLink2 39.968 SAPI: 0 TEI: 0 RF CHN REL Bm + ACCH TIMESLOT: 4
LU2 TLink1A SLink2 39.979 SAPI: 0 TEI: 0 RF CH RACK Bm + ACCH TIMESLOT: 4

EXERCISES 52 (199)
ll aa nn
kk
BB
iioonnaa
llllyy
ttnnee
ttnnII

EXERCISES 53 (199)
EXERCISE 8
A INTERFACE, Protocol Analyzer
During this exercise you will study signaling on A interface, recorded in a
logfile called lu1.msu. The corresponding signaling on Abis is also included.
To start the exercise, follow the instruction below (1-9):
1. Choose: “MPA Eventlog browser” in the program group “GN Nettest
MPA”.
2. Go to: “File”, “Open”.
3. Choose: lu1.msu.
4. To the right of the “format” button, there is a window displaying: “overview
- more lines”. Press the arrow pointing downwards and choose: “detailed -
all fields with hex”.
5. Press the “format” button. In the “Decode params” folder, choose
“relative” in the Time option box. Then go to the “Protocol layers” folder.
6. Choose “ETSI GSM A interface” in the window to the right of “Protocols,
in use:” Make sure there is an “x” in all the white boxes. That is, in: “MTP”,
“SCCP”, BSSAP”, BSSMAP”, “DTAP” and “SS”.
Choose “ETSI GSM Abis” in the window to the right of “Protocols, in use
”Make sure there is an “x” in all the white boxes. That is, in: “LAPD”,
“L2Mngt”, “Network Mngt”,“Traffic Mngt”, “DTAP” and “SS”.
7. Go to the “link colors” folder.
8. “LU1 TLink1A SLink1” is A interface uplink, lets have it in magenta.
“LU1 TLink1B SLink1” is A interface downlink, make it red.
“LU2 TLink1A SLink2” is Abis uplink, lets have it in blue.
“LU2 TLink1B SLink2” is Abis downlink, make it cyan.
Since we will not investigate LU2 TLink1A Slink1 nor LU2 TLink1B Slink1
we mark them black.
To color each entire message use the “Apply Color” box.
Click OK!
9. In the colored header of each frame there is a number for each frame.
The first frame in the logfile has No. 0.074.

EXERCISES 54 (199)
Below the header, the frame content is shown. There are three columns:
• In the left column the octets are displayed in hex.
• The middle column shows the names of the information fields in the
octet. Double click on the name for more info. Then exit.
• The right column shows the decoding of the information fields.
Your traffic case starts in frame 20.992 and ends in frame 23.375.
Try to answer the following questions. Where applicable make a note of
where in the logfile you found the answer.
1. On what interface is the message in frame no. 20.992 sent? Is it
an uplink or downlink message?
2. What happens in frames 20.992  21.040?
3. What timeslot is allocated to the MS for signaling?
4. How is that timeslot configured?
5. What kind of traffic case is this (frame 21.433)?

EXERCISES 55 (199)
Look at frame 21.451
6. Over which interface is this message sent?
7. Is it uplink or downlink?
8. What is the value of BSN and FSN in the first octet?
9. What information is given in the Length Indicator?
10. Look in the SIO field. Who is the MTP user?
11.
A. What is the name of the MTP user message?
B. Find the source local reference
12. This message initiates the ________________ signaling mode.
13. There are two pointers, one for mandatory and one for optional
parameters. What is the mandatory parameter?

EXERCISES 56 (199)
14. What kind of address information can be transferred in this
parameter and what information shall be used for routing of this
particular message?
15. There are two optional parameters. Look at the initial octets of the
second optional parameter.
A. What application protocol does this message belong to?
B. Which message in that protocol is it?
C. What upper layer information is carried over the interface in
this message?
16. Look at the message in frame 21.466.
A. Over which interface is this message transmitted?
B. Which direction?
C. What is the value of BSN and FSN (compare to previous
message)?
D. What is the name of the SCCP message?
E. What SCCP address information is included (compare
previous message)?
17. Look at the next message (21.478).
A. Over which interface is this message transmitted?
B. Which direction?
C. What is the value of BSN and FSN?
D. What is the name of the SCCP message?
E. What SCCP address information is included?

EXERCISES 57 (199)
18. In the BSSAP header you find the “discriminator” (DISC) and the
“data link connection identifier” (DLCI).
A. Is this a DTAP or BSSMAP message?
B. How will this message be sent over the air?
19. Which air interface message is it?
Look at the identity of the mobile subscriber.
20. What is the home network of this subscriber?
21. Describe briefly what happens in the frames 21.482 - 23.375.

EXERCISES 58 (199)
Printout of log file
=== LAPD ===
--- ADDRESS ---
CR : ......0.
EA0 : .......0
01 TEI : 0
EA1 : .......1
--- CONTROL ---
--- I_FRAME ---
94 N(S) : 74
IFORMAT : .......0
C6 N(R) : 99
P : .......0
--- INFO ---
=== TRAF MGMT ===
13 ExtBit : 0.......
MESS TYPE : 13h = Channel Required
--- CHAN RQD ---
01 IE ID : 01h
--- CHANNEL NO ---
88 CHANNEL : 10001... = Uplink CCCH (RACH)
TIMESLOT : 0
13 IE ID : 13h
--- REQ REF ---
1E RA : 1Eh
9B N32 : 19
89 N51 : 28
N26 : 9
11 IE ID : 11h
--- ACC DELAY ---
01 ACC DELAY : 1

EXERCISES 59 (199)
__________________________________________________________________
Error: Unknown optional parameter in SCCP Connection Request message
Error: PDU is shorter than expected
Error: Cannot find end of optional parameter list
=== MTP ===
95 BSN : 21
BIB : 1.......
E3 FSN : 99
FIB : 1.......
3D LI : 61 = MSU
SPARE : 00......
83 SIO : 83h = nSCCP
=== SCCP ===
2C 41 DPC : 0- 37-4
19 30 OPC : 0- 12-5
SLS : 3
01 MTYPE : 01h = CR
--- CR ---
1B 00 03 SRC LREF : 196635
--- PROT CLASS ---
02 PROT CLASS : 2 = Simple connection-oriented
SPARE : 0000....
02 MAND PTR : 2
06 OPT PTR : 6
04 LEN : 4
--- CALLED ---
43 RESERVED : 0.......
ROUT IND : .1......
GBLTIT IND : ..0000..
SUBSYS IND : ......1.
PC IND : .......1
2C 01 PC : 0- 37-4
SPARE : 00......
FE SUBSYS NO. : FEh = BSSAP
04 CODE : 04h
04 LEN : 4
--- CALLING ---
43 RESERVED : 0.......
ROUT IND : .1......
GBLTIT IND : ..0000..
SUBSYS IND : ......1.
PC IND : .......1
65 00 PC : 0- 12-5
SPARE : 00......
FE SUBSYS NO. : FEh = BSSAP
0F CODE : 0Fh
23 LEN : 35
--- DATA ---
=== BSSAP ===
--- DISC ---
00 SPARE : 0000000.
DISCR : .......0 = Not Transparent
21 LENGTH : 33
=== BSSMAP ===
57 MT : 57h = Complete Layer 3 Info
--- LAYER 3 ---
05 IE ID : 05h

EXERCISES 60 (199)
08 LEN : 08h
--- CELL ID ---
00 DISCRIMIN : 0
62 F2 MCC DIG : 262
SPARE : 1111....
20 MNC DIG : 02
00 01 LAC : 0001h
00 07 CI VALUE : 0007h
17 IE ID : 17h
12 LEN : 12h
=== DTAP ===
TIVAL : 0h
08 ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 08h = Location Updating Request
--- LOCUPDREQ ---
--- LOC UPDATE ---
72 TYPE : ......10 = IMSI attach
SPARE : ....00..
--- CIPHER KEY ---
KEY SEQ : 7
SPARE : 0.......
--- LOCAT AREA ---
62 F2 MCC : 262
FILLER : 1111....
20 MNC : 02
00 01 LAC : 0001h
--- MS CLASS 1 ---
03 REV. LEVEL : 000.....
ENCRYPTION : ...00... = Algorithm A5
RF POWER : .....011 = Class 4, handheld
--- MOBILE ID ---
08 LEN : 8
29 TYPE : 1 = IMSI
26 20 04 88
09 01 30 IDENTITY : 262024088901003
21 CODE : 21h
01 LEN : 1
--- UNKNOWN ---
00 DATA : 00h

EXERCISES 61 (199)
_________________________________________________________________
=== MTP ===
E3 BSN : 99
BIB : 1.......
96 FSN : 22
FIB : 1.......
0E LI : 14 = MSU
SPARE : 00......
=== SCCP ===
65 00 DPC : 0- 12-5
4B E0 OPC : 0- 37-4
SLS : 14
02 MTYPE : 02h = CC
--- CC ---
1B 00 03 DEST LREF : 196635
B0 00 02 SRC LREF : 131248
--- PROT CLASS ---
02 PROT CLASS : 2 = Simple connection-oriented
SPARE : 0000....
00 OPT PTR : 0

EXERCISES 62 (199)
=== MTP ===
E3 BSN : 99
BIB : 1.......
97 FSN : 23
FIB : 1.......
20 LI : 32 = MSU
SPARE : 00......
=== SCCP ===
65 00 DPC : 0- 12-5
4B E0 OPC : 0- 37-4
SLS : 14
06 MTYPE : 06h = DT1
--- DT1 ---
1B 00 03 DEST LREF : 196635
--- SEGM/REASM ---
00 MORE DATA : .......0 = no more data
SPARE : 0000000.
01 MAND PTR : 1
14 LEN : 20
--- DATA ---
=== BSSAP ===
--- DISC ---
01 SPARE : 0000000.
DISCR : .......1 = Transparent
--- DLCI ---
00 CBIT : 00...... = FACCH/SDCCH
SPARE : ..000...
SAPI : .....000 = Call Control, Mobility Mgmt,
Radio Resources
11 LENGTH : 17
=== DTAP ===
TIVAL : 0h
02 ExtBit : 0.......
N(SD) : .0......
MESS TYPE : 02h = Location Updating Accept
--- LOCUPDACC ---
--- LOCAT AREA ---
62 F2 MCC : 262
FILLER : 1111....
20 MNC : 02
00 01 LAC : 0001h
--- MOBILE ID ---
17 IE ID : 17h
08 LEN : 8
29 TYPE : 1 = IMSI
26 20 04 88
09 01 30 IDENTITY : 262024088901003

EXERCISES 63 (199)
LU2 TLink1A SLink2 20.992 SAPI: 0 TEI: 0 CHAN RQD Uplink CCCH (RACH) TIMESLOT: 0
LU2 TLink1B SLink2 21.016 SAPI: 0 TEI: 0 CHAN ACTIV SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU2 TLink1A SLink2 21.029 SAPI: 0 TEI: 0 CH ACT ACK SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU2 TLink1B SLink2 21.040 Error: Unknown Message Type SAPI: 0 TEI: 0 IMM AS CMD Downlink
CCCH (PCH + AGCH) TIMESLOT: 0 ???
LU2 TLink1A SLink2 21.433 SAPI: 0 TEI: 0 EST IND SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
Location Updating Request IMSI
262024088901003
LU1 TLink1A SLink1 21.451 Error: Unknown optional parameter in SCCP Connection Request message
Error: PDU is shorter than expected
Error: Cannot find end of optional parameter list
MSU nSCCP 0- 37- 4 0- 12- 5 3 CR 0- 37- 4 FE 0- 12- 5 FE Complete Layer 3 Information CELL ID 262
02 0001 0007
Location Updating Request IMSI 262024088901003
LU1 TLink1B SLink1 21.466 MSU nSCCP 0- 12- 5 0- 37- 4 14 CC
LU1 TLink1B SLink1 21.478 MSU nSCCP 0- 12- 5 0- 37- 4 14 DT1 Location Updating Accept IMSI
262024088901003
LU1 TLink1B SLink1 21.482 MSU nSCCP 0- 12- 5 0- 37- 4 14 DT1 Clear Command CAUSE Call control
LU2 TLink1B SLink2 21.492 SAPI: 0 TEI: 0 DATA REQ SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
Location Updating Accept IMSI
262024088901003
Channel Release Normal Release
LU1 TLink1A SLink1 21.498 MSU nSCCP 0- 37- 4 0- 12- 5 3 DT1 Clear Complete
LU2 TLink1B SLink2 21.502 SAPI: 0 TEI: 0 DACT SACCH SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU1 TLink1B SLink1 21.511 MSU nSCCP 0- 12- 5 0- 37- 4 14 RLSD end user originated
LU2 TLink1A SLink2 21.512 SAPI: 0 TEI: 0 UI MEAS RES SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
Measurement Report
LU1 TLink1A SLink1 21.522 MSU nSCCP 0- 37- 4 0- 12- 5 14 RLC
Measurement Report
Measurement Report
LU2 TLink1B SLink2 23.364 SAPI: 0 TEI: 0 RF CHN REL SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU2 TLink1A SLink2 23.375 SAPI: 0 TEI: 0 RF CH RACK SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU1 TLink1B SLink1 21.478 MSU nSCCP 0- 12- 5 0- 37- 4 14 DT1 Location Updating Accept IMSI
262024088901003

EXERCISES 64 (199)
LU1 TLink1B SLink1 21.482 MSU nSCCP 0- 12- 5 0- 37- 4 14 DT1 Clear Command CAUSE Call control
Location Updating Accept
IMSI 262024088901003
Channel Release Normal
Release
LU1 TLink1A SLink1 21.498 MSU nSCCP 0- 37- 4 0- 12- 5 3 DT1 Clear Complete
LU2 TLink1B SLink2 21.502 SAPI: 0 TEI: 0 DACT SACCH SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU1 TLink1B SLink1 21.511 MSU nSCCP 0- 12- 5 0- 37- 4 14 RLSD end user originated
Measurement Report
LU1 TLink1A SLink1 21.522 MSU nSCCP 0- 37- 4 0- 12- 5 14 RLC
Measurement Report
Measurement Report
LU2 TLink1B SLink2 23.364 SAPI: 0 TEI: 0 RF CHN REL SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2
LU2 TLink1A SLink2 23.375 SAPI: 0 TEI: 0 RF CH RACK SDCCH/ 8 + ACCH, subch. 1 TIMESLOT: 2

EXERCISES 65 (199)
EXERCISE 9
Network Service Part (NSP)
In this exercise you will examine the SCCP addressing information used on
the A interface and in the Switching System. The provided printout of a log file
contains all the SCCP fields found in messages exchanged during a certain
traffic case. The data fields are not decoded.
In order to complete the exercises you need to find out some information
about the nodes and messages:
1. Nodes: for every node involved in the traffic case fill in the type of the
node and the address of the node in the network (use the square fields
above the vertical lines)
2. Messages: for every message sent in transmitted during the traffic case
find out its direction (add arrows to the lines representing the messages),
the name of the SCCP message (insert it into the smaller rectangle above
the message) and the addressing information used by SCCP for the
routing of the message (insert it into the larger rectangle above the
message).
For your answer you can use the form provided on the next pages. The round
field above every message contains the message number as found in the log
file.

EXERCISES 66 (199)
BSC
SPC = 2-6058
CR Address:DPC = 2-10368, SSN=BSSAP
1
2
4
5
6
9
10
11
12
8
7
3

EXERCISES 67 (199)
BSC
SPC = 2-6058
13
14
15
16
17
18
19
20
21
22
23
24

EXERCISES 68 (199)
Printout of log file
Message 1
HH:MM:ss"m FROM TYPE SIO DPC OPC SLS CIC NAME
14:16:53"6 b1bs SCCP 83 10368 6058 13 CR
ITU-T WHITE BOOK SCCP (SCCP) Connection Request (CR)
----0011 Service Indicator SCCP
--00---- Sub-Service: Priority Spare/priority 0 (U.S.A. only)
10------ Sub-Service: Network Ind National message
******** Destination Point Code 10368
******** Originating Point Code 6058
******** Signaling Link Selection 13
00000001 SCCP Message Type 0x1
******** Source Local Reference 0x90048
----0010 Protocol Class Class 2
0000---- Spare
00000010 Ptr to Called address pa 2
00000110 Ptr to optional param. 6
Called address parameter
00000100 Parameter Length 4
-------1 Point Code Indicator PC present
------1- Subsystem No. Indicator SSN present
--0000-- Global Title Indicator No global title included
-1------ Routing Indicator Route on DPC + Subsystem No.
0------- For national use 0
******** Called Party SPC 10368
00------ Spare
11111110 Subsystem number BSSAP
Calling address parameter
00000100 Parameter name Calling party address
******** Calling Party SPC 6058
00------ Spare
11111110 Subsystem number BSSAP
Data parameter
00001111 Parameter name Data
00100000 Parameter length 32
******** Data 00 1E 57 05 08 00 62 F2 20 00 02 00
08 17 0F 05 08 00 62 F2 20 00 03 23
05 F4 00 00 40 DD 21 81
00000000 Parameter name End of Optional Params

EXERCISES 69 (199)
Message 2
14:16:53"7 mapr SCCP 83 6049 10368 11 UDT
ITU-T WHITE BOOK SCCP (SCCP) Unitdata (UDT)
1000---- Message Handling Return message on error
00000101 Ptr to Calling address p 5
00001001 Ptr to Data parameter 9
-------0 Point Code Indicator PC absent
00000111 Subsystem number VLR
00------ Spare
Data parameter
******** Data 62 20 48 04 FA 00 14 4E 6C 18 A1 16
02 01 01 02 01 09 30 0E 81 04 00 00
40 DD 30 06 0A 01 00 0A 01 01

EXERCISES 70 (199)
Message 3
14:16:53"7 b1br SCCP 83 6058 10368 9 CC
ITU-T WHITE BOOK SCCP (SCCP) Connection Confirm (CC)
******** Destination Local Ref. 0x90048
******** Source Local Reference 0x21009
0000---- Spare
00000000 Ptr to optional param. 0

EXERCISES 71 (199)
Message 4
14:16:53"7 maps SCCP 83 10368 6049 14 UDT
00------ Spare
--0100-- Global Title Indicator Has transln,n-plan,code,natur
-0------ Routing Indicator Route on Global Title
00000000 Translation Type Not used
----0010 Encoding Scheme BCD, even number of digits
0001---- Numbering Plan ISDN/Telephony (E.164/E.163)
-0000011 Nat. of Address Indicator National significant number
0------- Spare
******** Calling Address Signals 1725100097
Data parameter
******** Data 64 1E 49 04 FA 00 14 4E 6C 16 A2 14
02 01 01 30 0F 02 01 09 30 0A 80 08
62 02 52 01 00 97 47 F1

EXERCISES 72 (199)
Message 5
14:16:53"8 mapr SCCP 83 6049 10368 1 UDT
00000110 Subsystem number HLR
00------ Spare
Data parameter
******** Data 62 21 48 04 FA 00 15 47 6C 19 A1 17
02 01 01 02 01 09 30 0F 80 08 62 02
52 01 00 97 47 F1 30 03 0A 01 01

EXERCISES 73 (199)
Message 6
14:16:53"8 maps SCCP 83 10368 6049 15 UDT
00------ Spare
0------- Spare
Data parameter
******** Data 64 81 82 49 04 FA 00 15 47 6C 7A A2
78 02 01 01 30 73 02 01 09 30 80 A1 22 04 10 A6 6C 02 8C 4E 67 A3 40 1C
11 7F 38 86 CC 19 DE 04 04 5E 03 61 0C 04 08 BE B3 01 4A E7 D1 30 00 A1
22 04 10 3D 20 CB 79 B7 47 93 4C 9C BE 9C 6C 08 85 4B 4F 04 04 32 0B 28
0E 04 08 E3 04 52 6E 9E 19 10 00 A1 22 04 10 B5 7F 78 5F 8F 3F 2E C6 CE
30 E0 D2 4F 08 51 C8 04 04 02 9F A7 AD 04 08 15 96 63 A5 FC D1 78 00 00
00

EXERCISES 74 (199)
Message 7
14:16:53"9 b1br SCCP 83 6058 10368 9 DT1
ITU-T WHITE BOOK SCCP (SCCP) Data Form 1 (DT1)
-------0 Segment/reass M indicator No more data
0000000- Spare
Data parameter
******** Data 01 00 13 05 12 01 A6 6C 02 8C 4E 67
A3 40 1C 11 7F 38 86 CC 19 DE
Message 8
14:16:55"5 b1bs SCCP 83 10368 6058 13 DT1
ITU-T WHITE BOOK SCCP (SCCP) Data Form 1 (DT1)
-------0 Segment/reass M indicator No more data
0000000- Spare
Data parameter
******** Data 01 00 06 05 54 5E 03 61 0C

EXERCISES 75 (199)
Message 9
14:16:55"6 mapr SCCP 83 6049 10368 4 UDT
00------ Spare
Data parameter
******** Data 62 50 48 04 FA 00 17 47 6B 1A 28 18
06 07 00 11 86 05 01 01 01 A0 0D 60
0B A1 09 06 07 04 00 00 01 00 01 02
6C 2C A1 2A 02 01 01 02 01 02 30 22
04 08 62 02 52 01 00 97 47 F1 81 07
91 94 71 72 06 00 79 04 07 91 94 71
72 06 00 79 8A 04 00 00 00 01

EXERCISES 76 (199)
Message 10
14:16:55"7 maps SCCP 83 10368 6049 6 UDT
00------ Spare
0------- Spare
Data parameter
******** Data 65 81 C6 48 03 CC 00 FF 49 04 FA 00
17 47 6B 2A 28 28 06 07 00 11 86 05 01 01 01 A0 1D 61 1B 80 02 07 80 A1
09 06 07 04 00 00 01 00 01 02 A2 03 02 01 00 A3 05 A1 03 02 01 00 6C 80
A1 81 88 02 01 04 02 01 07 30 80 81 07 91 94 71 52 71 79 14 82 01 0A 83
01 00 A4 12 04 01 11 04 01 12 04 01 13 04 01 14 04 01 15 04 01 16 A6 0F
04 01 11 04 01 21 04 01 22 04 01 61 04 01 62 A7 80 A0 80 04 01 21 30 80
30 06 83 01 10 84 01 (there was more, deleted)

EXERCISES 77 (199)
Message 11
14:16:55"8 mapr SCCP 83 6049 10368 11 UDT
00------ Spare
Data parameter
******** Data 65 12 48 04 FA 00 17 47 49 03 CC 00
FF 6C 05 A2 03 02 01 04

EXERCISES 78 (199)
Message 12
14:16:55"8 maps SCCP 83 10368 6049 6 UDT
00------ Spare
0------- Spare
Data parameter
******** Data 65 81 D2 48 03 CC 00 FF 49 04 FA 00
17 47 6C 81 C4 A1 81 C1 02 01 05 02 01 07 30 80 A7 80 A0 80 04 01 2A 30
80 30 06 83 01 10 84 01 04 30 06 83 01 60 84 01 04 30 06 82 01 10 84 01
04 00 00 00 00 A0 80 04 01 2B 30 80 30 06 83 01 10 84 01 04 30 06 83 01
60 84 01 04 30 06 82 01 10 84 01 04 00 00 00 00 A1 25 04 01 92 30 20 30
06 83 01 10 84 01 04 30 06 83 01 20 84 01 04 30 06 83 01 60 84 01 04 30
06 82 01 10 84 01 04 A1 25 04 01 93 30 20 30 06 83 01 10 84 01 04 30 06
83 01 20 84 01 04 30 06 (there was more, deleted)

EXERCISES 79 (199)
Message 13
14:16:55"8 maps SCCP 83 10368 6049 6 UDT
00------ Spare
0------- Spare
Data parameter
******** Data 65 81 8C 48 03 CC 00 FF 49 04 FA 00
17 47 6C 7F A1 7D 02 01 06 02 01 07 30 80 A7 80 A1 0D 04 01 94 30 08 30
06 82 01 10 84 01 04 A3 06 04 01 71 84 01 05 A3 06 04 01 51 84 01 05 A3
09 04 01 12 84 01 05 82 01 00 A3 06 04 01 14 84 01 05 A3 09 04 01 11 84
01 05 81 01 01 A3 09 04 01 13 84 01 05 81 01 01 A3 0B 04 01 41 84 01 04
30 03 83 01 10 A3 0B 04 01 41 84 01 04 30 03 83 01 60 A3 0B 04 01 41 84
01 04 30 03 82 01 10 00 00 00 00

EXERCISES 80 (199)
Message 14
14:16:55"9 mapr SCCP 83 6049 10368 10 UDT
00------ Spare
Data parameter
******** Data 65 12 48 04 FA 00 17 47 49 03 CC 00
FF 6C 05 A2 03 02 01 05

GSM advanced system technique

Recommended

Recommended

More Related Content

Similar to GSM advanced system technique

Similar to GSM advanced system technique (16)

Recently uploaded

Recently uploaded (20)

GSM advanced system technique