AUTHORS

Subha Narasimhan
subha.narasimhan@wipro.com

Dama Prem Kumar

prem.kumar@wipro.com

ABSTRACT

Call tracing is very useful for offline analysis of the messages exchanged between various
network elements during a call. This can be used in functional testing of network elements. This
paper gives details on how a call can be traced from source to destination in GSM network. This
can be considered as a base for doing the same feature in next generation mobile networks.
WHITE PAPER CALL TRACE IN GSM

   !#"%$ &

The mobile telecommunications industry has experienced unprecedented growth over the last ten
to twenty years. The popularity and use of mobile telephones will undoubtedly increase in the
future with this kink of rapid growth.

The following diagram gives the basic mobile system in GSM.

Home Location Visitor Location

Register (HLR) Register (VLR)

Air Interface (Um)

C Interface B Interface
Abis Interface
A Interface

Mobile Switching Centre (MSC)

F Interface
Base Station
Controller (BSC)
Air Interface (Um)
Equipment Identity
Register (EIR)

Abis Interface

Operation and Maintenance

Standardized Interface Centre (OMC)
Non-Standardized Interface

Following are the components of the GSM network

° The Mobile Phone or Mobile Station, that is carried by the subscriber.

° The Base Transceiver Station (BTS) which sends or receives signals from/to Mobile Station.
The Base Station Controller (BSC) which allocates resources to mobile and controls BTS.
BSC and BTS together are called Base Station Subsystem (BSS).
° Mobile Switching Center (MSC) which switch the calls from one network to other network. It
accesses the databases Home Location Register (HLR), Visitor Location Register (VLR) and
Equipment Identity Register (EIR), to switch the calls. All the databases and MSC forms
Network Subsystem (NSS).
° Operations and Maintenance Center, which oversees the proper operation and setup of the
network.

2  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

Following are the interfaces between various network elements.

° The mobile station and the BSS communicate across the Um interface, also known as air
interface or radio link.
° BTS communicates with BSC across Abis interface
° BSC communicates with MSC across A interface
° MSC communicates with VLR across B interface
° MSC communicates with HLR across C interface
° MSC communicates with EIR across F interface
° The interface between OMC and other network elements is not standardized

' ( )+*,-*.0/1/2,43658715:9;9
<>=@? ACBEDFHGJILKNMOQPRP
A call can be either mobile originated call (MOC) or mobile terminated call (MTC). Mobile
originating means the subscriber is making a call from mobile. Mobile terminated call means the
subscriber is receiving a call. Only the trigger for the initiation of the mobile to establish the
connection with BTS is different in MOC and MTC. The progress of the call from initiation is
same in both the cases.

2.1.1 Mobile originated call

To make a call, radio resources are required. When the subscriber tries to make a call, the
mobile tries to acquire random access channel (RACH) using which it can request network to
allocate resources. It sends CHAN_REQ message to BTS, through RACH. This message is
received by BTS and it passes this information to BSC, through the message CHAN_RQD. On
receiving this message, BSC allocates dedicated channel for this mobile and sends the message
CH_ACT to BTS, which instructs BTS to activate the channel specified in the message for this
mobile. BTS activates the channel and send CH_ACT_ACK message to BSC. BSC then sends
IMM_ASS_CMD to the mobile on the access grant channel (AGCH), indicating that it has
assigned a dedicated channel. This message contains the channel details to which the mobile
should tune. Thus the dedicated channel is assigned to mobile and it starts using it.

Once the dedicated channel is assigned, BSC starts establishing a connection with the MSC. The
transport mechanism defined to carry signaling information between BSS and MSC is SS7 stack
(MTP and SCCP layers). BSS initiates a SCCP connection by sending Connection Request (CR)
message with Layer 3 information indicating the need of SCCP connection. The MSC confirms
the connection by sending Connection Confirm (CC) message to BSC. Then on the messages
get exchanged between BSC and MSC using the SCCP connection.

After the completion of authentication and ciphering procedure, BSC allocates traffic channel to
Mobile using DATA_REQ(Assignment_cmd). It also activates the traffic channel using CH_ACT
message. Then on the mobile uses this traffic channel for the call.

If the mobile is trying to make a call with a mobile which is under the control of other MSC, or if it
is other network, then MSC-MSC interaction is possible. For this interaction MSCs uses ISUP
(Integrated Services Digital Network user Part). The ISDN User Part makes use of SCCP and
MTP of SS7. ISUP setup, manage and release trunk circuits that carry voice and data between
terminating line exchanges. ISUP is used for both ISDN and non-ISDN calls. However the calls
that originate and terminate at the same switch do not use ISUP signaling.

So, here if the mobile tries to reach a subscriber under the control of other MSC or if it is in
different network, the originating MSC transmits ISUP Initial Address Message (IAM) to reserve a
idle trunk circuit from the originating switch to the destination switch. The destination MSC then

3  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

finds out the location of called party by accessing HLR/VLR using Mobile Application Protocol
(MAP) messages. Once it has located the called party, it rings the called party and transmits an
ISUP Address Complete (ACM) message to the originating MSC. When the called party picks up
the phone, the destination MSC terminates the ringing tone and transmits ISUP Answer Message
(ANM) to the originating MSC. From then on the call proceeds.

When the calling party hangs-up first, mobile sends Disconnect message to BSC. On receiving
this MSC initiates the release by sending Release message to BSC. BSC sends this message to
BTS and this is forwarded to the mobile station. The mobile station deallocates the radio
resources. Then the MSC sends an ISUP Release message (REL) to release the trunk circuit
between the two MSCs. On receiving REL, destination MSC disconnects the trunk from called
party’s line and sends ISUP Release Complete (RLC) message to the originating MSC. Thus
ISUP connection is terminated. Now MSC starts terminating the radio resources and the SCCP
connections. It then sends SCCP Released (RLSD) to disconnect the SCCP connection. BSC
replies with SCCP Release Complete (RLC) message. Thus SCCP connection is terminated for
this mobile. BSC then sends RF_CH_REL message to BTS instructing BTS to release the
channel associated with the mobile. The BTS acknowledges by sending RF_CH_REL_ACK
message. Now all the resources allocated to the mobile will be de-allocated.

2.1.2 Mobile terminated call

Here the mobile is receiving call from other mobile or other land line connection. When a mobile
gets a call, the network pages the mobile indicating it to establish a radio link through the
message UDT(PAGING). On receiving this message, mobile initiates CCCH connection by
sending CHAN_REQ. Rest is same as in Mobile Originated call.
S>T;S UVHW0XY[ZE\^]
When the subscriber is moving away from the BTS/BSC while making a call, then the signal
strength is weakened due to which the call may be dropped. To avoid this, when the signal
strength is weakened the call is handed over to adjacent BTS/BSC towards which the mobile is
moving and for which the signal strengths is more. Thus handover is transferring the control on a
mobile from one network element to other network element.

Following are various types of handover.

1. Intra cell handover, which involves in changing the channel or time slot of the channel that is
assigned to the mobile.
2. Intra BSC handover, which involves in handing over the call to other cell, with in the scope of
BSC.
3. Inter BSC, Intra MSC handover, which involves in handing over the call to other BSC with in
the scope of MSC
4. Inter MSC handover, which involves in handing over the call to other MSC.
_>`;a bcCdefhgRcCikjmlneofhgpiEq
Geographically the network service area is divided into cells. More than one cell forms a Location
Area (LA). More than one LA forms a MSC/VLR area. Thus the MSC will control all the
subscribers present in the LA at particular point of time. Before an MS can make or receive calls
it must register with the network by performing a function known as a Location Update (LU). With
this, the network can keep track of he location of MSs in the network service area. To achieve
this, each MS whenever it crosses the location area, will periodically perform LU procedure. The
resultant location information is stored in HLR and VLR, which will be accessed by MSC to switch
the call to the mobile.

4  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

rs tvuww x0yz{ uw!z|}Ey1x

What is a connection?

Connection is a group of messages sent on a particular logical channel in an interface. The

starting and ending messages of a connection are well defined. The type of connection depends
on the type of logical channel.

For example on Abis interface following type of connections are possible.

° CCCH - Common Control Channel
° SDCCH - Stand alone Dedicated Control Channel
° TCH - Traffic Channel

The establishment of CCCH connection starts with CHAN_RQD message and ends with
IMM_ASS_CMD message. IMM_ASS_CMD message contains Request reference number and
TDMA value. This set of parameter is unique for a call. CHAN_RQD message also contains
these two parameters. So the CCCH connection can be traced by using these two parameters.

The establishment of SDCCH and TCH starts with CH_ACT message and ends with
RF_CH_REL_ACK message. All the messages that forms the part of the SDCCH/TCH
connection will have logical channel number. Using this all the messages that forms the part of
the connection can be traced.

Similarly on A interface following type of connection is possible

° SCCP - Signaling Connection Control Part
The establishment of SCCP connection starts with the message CR (sent by BSC or MSC) and
ends with RLC (sent by BSC or MSC). Every message of an SCCP connection has a connection
reference numbers called DLR (Destination Local Reference) or SLR (Source Local Reference)
or both. This set of number is unique for a SCCP connection. Thus using this an SCCP
connection can be traced.

On E interface, that is the interface between 2 MSCs, following connection is possible

° ISUP - Integrated Services Digital Network User Part

The establishment of ISUP connection starts with IAM message and ends with RLC message. All
ISUP messages that belong to a single connection can be identified using the unique number
CIC. CIC (Circuit Identification Code) indicates the trunk circuit reserved by the originating switch
to carry the call.

On B, C and F interface following connections are possible

° MAP - Mobile Application Part

MAP is application layer protocol defined by GSM to manage the interfaces between different
network elements in NSS. MAP uses the services of TCAP, MTP and SCCP. MAP connection
starts with Begin message and ends with End message. A MAP connection in an interface can be
identified using Originating ID and Destination ID parameters. This set will be unique for a given
MAP connection.

While tracing a connection, care should be taken that the messages are exchanged between the
same network elements.

5  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

~ €vE‚ ‚Hƒ„E…1†

What is call tracing?

Identification of all connections that forms the part of a call is called call trace.

Connection trace is easy, as the start and end messages are defined and also it spans in only
one interface. But call trace spans across all interfaces. So complexity is involved in finding out
the link between the connections of different interfaces.

In order to trace a call from end to end we should first know how to group all the messages
belonging to a particular call, because many subscribers will be making/receiving calls. Also,
location updation procedure by mobile might also go on parallel. So tracing a call becomes
complex in these situations.

Based on certain parameters between the messages across different interfaces, a call can be
traced from end to end. The following section describes how the tracing of a call can be done.
‡>ˆ@‰ Š‹ŒH1Ž’‘”“Ep0•–‹’‘”‘—ŒH˜—Œ^1Ž ™oš4>0ŒQ™›ŽRšQEœJš[‘N2™oHžRž
This section gives the details of how to identify different connections that form a part of a call. We
will see how this can be done in each interface.

4.1.1 Abis Interface

CCCH connection and SDCCH connection in Abis interface can be mapped using
IMM_ASS_CMD message in CCCH connection and CH_ACT message in SDCCH connection.
Both these messages will have the same channel number, if they form the part of same call. Thus
CCCH and SDCCH connection can be traced. Similarly a TCH connection and an SDCCH
connection can be traced using DATA_REQ(Assignment_cmd) message in SDCCH connection
and CH_ACT message in TCH connection. Both these messages will have the same logical
channel number.

Following figures gives the mapping of CCCH with SDCCH and SDCCH with TCH connections
respectively in Abis interface.
BTS BSC
CHAN_RQD

Channel
Request Reference Number
number, TDMA

CH_ACT

Channel
Number

CH_ACT_ACK

Channel Number

IMM_ASS_CMD

Channel
Request Reference Number
number, TDMA

6  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM
BTS BSC
CH_ACT

Channel Number

DATA_REQ (Assignment_cmd)

Channel Number

Channel
description

CH_ACT_ACK
Channel Number
RF_CH_REL

RF_CH_REL_ACK
Channel Number

RF_CH_REL
Channel Number

RF_CH_REL_ACK
Channel Number

4.1.2 A Interface

A Call can have more than one SCCP connection if there is a handover. When there is a
Handover of the call from one channel to other channel, a new SCCP connection is formed. The
new SCCP connection for a handover is requested through CR(HO_REQ), from MSC to BCE,
which is the reason for the connection request. The response for this message is a Connection
Confirm message, CC(HO_REQ_ACK(Handover_Cmd)) from BCE to MSC. This triggers a
DT1(HO_CMD(Handover_Cmd)) from this MSC. Both the messages contain the same COM L3
Info with identical values for channel description and handover request. Thus with these two
messages the old and the new SCCP connections can be linked. Following figure indicates the
mapping between two SCCP connections.

BSC1 MSC BSC2

CR (Layer 3 info)

SLR
CC

DLR, SLR

DT1(HO_RQD)
CR(HO_REQ)
DLR
SLR

DT1(HO_CMD(Handover_cmd)) CC(HO_REQ_ACK(Handover_Cmd))
DLR, SLR
DLR Handover reference
Handover reference Channel number
Channel number

RLSD
DLR, SLR
RLC
DLR, SLR

7  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

4.1.3 ISUP Interface

In case of ISUP, there can be only one connection that is possible in a call. The flow of
messages in ISUP is as shown.
MSC1 MSC2

IAM
CIC = 5

ACM
CIC = 5

ANM

CIC = 5
•
•
REL

CIC = 5
RLC

CIC = 5

4.1.4 MAP Interface

A map call consists of many connections. Each map connection begins with a Begin message
and ends with an End message. In between Begin and the End message, Continue messages
can also be encountered. Each message has an Originating ID or a Destination ID or both. Some
messages of map connection have IMSI/TMSI, Roaming number, and Called party number. Two
map connections can be mapped with IMSI or TMSI or called party number.

HLR VLR1 VLR2

Begin(SendParametersArg)
Begin(UpdateLocationArg)

IMSI/TMSI OrigID= 4D
OrigID=F3 IMSI/TMSI

Continue(InsertSubscriberdata) End(SendParametersRes)

DestnID=4D
OrigID=FA, DestnID=F3
Continue(InsertSubscriberdata)

OrigID=FA, DestnID=F3

.
.
.
End(UpdateLocationRes)

DestnID=F3

8  Wipro Technologies
 WHITE PAPER CALL TRACE IN GSM

Ÿ> ;¡ ¢¤£H¥¥C¦¨§0©–ª[«N£Q¬R¬4­oªC§0§0®H­°¯¦RªQ§0±²£H­o³—ªQ±o±J£H¬¨¬Q¦R§1¯®H³”«—£H­o®H±
In previous sections, we saw how different connections in the same interface being mapped. Now
we will see how to map all the connections across all the interfaces. If this mapping is done, then
end to end call can be traced.

4.2.1 Mapping from Abis to A interface and vice versa

The message in A interface that is used to link Abis messages are CR(COM L3 INFO). Just
before this message, in Abis message, there is a message EST_IND(COM L3 INFO). The IMSI,
TMSI or IMEI that is present in both the messages should be same. If that is case, the both these
messages form a part of the call. Once a link message is got in other interface, then tracing the
call in that interface is easy. (As explained in above sections).

If there is a handover, the messages in A interface that are used to link Abis interface are
DT1(HO_CMD(Handover_Cmd)) and CC(HO_REQ_ACK(Handover_Cmd)). Both the messages
have Handover Reference and the new channel description, which is given to the Abis link. This
information is present in the messages CH_ACT and DATA_REQ(Handover_command) of Abis
interface. Through this link, the A and Abis interface messages can be linked.

The following figure gives the above mentioned mapping:

BTS BSC1 MSC

BSC2
.
.
EST_IND (Layer 3 info)
CR (Layer 3 info)

Channel IMSI/TMSI/IMEI
number IMSI/TMSI/IMEI SLR

.
.
.
.
DT1(HO_RQD)

CR(HO_REQ)
DLR

SLR
CC(HO_REQ_ACK(Handover_
cmd))
DT1(HO_CMD(Handover_
cmd))
DLR
DATA_REQ(HO_CMD) Handover reference,
Channel description
DLR
Handover reference,
Channel Channel description
number Handover reference,
Channel description

9  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

4.2.2 Mapping from A to ISUP interface

The link between A and ISUP interface is the Called Party Number or the Calling Party Number.
The message IAM in ISUP interface is having Called Party Number as a Mandatory parameter
and the Calling Party Number as the optional parameter. The message DT1(Set_up) in A
interface is having Called Party Number as the Mandatory Parameter when it is a MOC. When it
is a MTC, the DT1(Set_up) is having a Calling Party Number as the optional parameter. Thus
using this, A and ISUP interface can be linked.

BSC MSC1 MSC2

.
.
CR(COM_L3_INFO(Paging
_Respsonse))

SLR CC

DLR,SLR
DT1(Set_up)
IAM
DLR Calling party Number
CIC
Calling party Number,
. Called party Number

4.2.3 Mapping of MAP interface with other interfaces.

Following are the links from the MAP interface to other interfaces.

1. On A interface

° DT1 (Set-up) is an entry point, whose ISDN called party number matches with the MSISDN of
the MAP call.
° “CR(COM_L3_INFO(…” is an entry point, whose IMSI or TMSI matches with the IMSI or
TMSI of the MAP call.

2. On Abis interface

° DATA_REQ (Set-up) is an entry point, whose ISDN called party number matches with the
MSISDN of the MAP call.
° UDT(PAGING) is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of the
MAP call.
° PAGING_CMD is an entry point, whose IMSI or TMSI matches with the IMSI or TMSI of the
MAP call

Thus whichever message is available, corresponding parameter as mentioned above has to be

used to map MAP connections with other connections.

10  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

´µ ¶v·¸¹»º ¼ ½1¾ ·¸

Apart from testing the functionality of network elements, call trace is also helpful in analyzing
problems occurring in field. If any problem occurs, it may not be possible for the experts to go to
the problem site and analyze it. Instead, the messages exchanged can be registered and can be
analyzed offline. When a call is made, the messages exchanged between the network elements
can be registered in a file. This file can be read and the messages can be represented
graphically. Call tracing can be done for the messages in the file by selecting a message. The
traced call can be highlighted and the messages can be analyzed for any discrepancies. Manual
tracing of the call might involve lot of effort and expertise. Instead, if it is automated as stated in
this paper, then it will be very useful in analysis.
¿À ÁÂ1ÃhÂEÄÂEÅ Æ1Â0Ç
1. GSM 4.08 – Mobile Radio interface layer 3 specification
2. GSM 8.58 – Base Station Controller – Base Transceiver Station (BSC - BTS) interface Layer
3 specification
3. GSM 8.08 – Mobile-services Switching Centre – Base Station System (MSC – BSS) interface
Layer 3 specification.
4. GSM 9.02 – Mobile Application Part Specification
5. GSM 1.04 – Abbreviations and Acronyms
6. CCITT – Recommendations for Integrated Services Digital Network User Part (ISUP) – Q.761
to Q.764
7. ITU – T Recommendations for Signalling Connection Control Part (SCCP) Q.711 – Q.715
ÈÉ ÊË1ÌÍÎ>ÏÐÒÑ
BTS Base Transceiver Station
BSC Base Station Controller
CIC Circuit Identification Code
COM L3 Complete Layer three Information. The following are
Info COML3 Info that comes with CR in A interface and
EST_IND in Abis:
° CM Service Request
° CM Reestablishment Request
° Paging Response
° Location Update Request
° IMSI Detach Indication
DLR Destination Local Reference
HLR Home Location Register
IMSI International Mobile Subscriber Identity
ISDN Integrated Services Digital Network
ISUP Integrated Services Digital Network User Part
MAP Mobile Application Part
MOC Mobile Originated Call
MTP Message Transfer Part
MSC Mobile-services Switching Centre, Mobile Switching Centre
MSIN Mobile Subscriber Identification Number
MSISDN Mobile Station International ISDN number
MTC Mobile Terminated Call
NE Network element
SCCP Signalling Control Connection part
SLR Source Local Reference
SS7 Signaling System 7. MTP and SCCP are part of it.
TDMA Time Division Multiple Access
TMSI Temporary Mobile Subscriber Identity
VLR Visitor Location Register

11  Wipro Technologies
WHITE PAPER CALL TRACE IN GSM

About the Authors

Subha Narasimhan is a Systems Manager in Wireless Business Unit of Telecom and
internetworking Group at Wipro Technologies. She is a domain expert in Telecom (GSM, GPRS
& UMTS) and Protocol systems. She has a master degree in Computer applications.

Dama Prem Kumar is a Systems Manager in Wireless Business Unit of Telecom and
internetworking Group at Wipro Technologies. He is a domain expert in Telecom (GSM, GPRS &
UMTS) and Protocol systems. He has a Bachelors degree in Computer science and Engineering.

About Wipro Technologies

Wipro Technologies is the global technology services division of Wipro Limited (NYSE: WIT). It
provides turnkey solutions for Finance, Retail, Utilities, Telecom and Technology clients. The
focus is largely in the areas of information services outsourcing and technology software
development. The company’s top clients include Lucent, Canon, Epson, Hitachi, Sony, Toshiba,
Cisco, IBM, ARM, AT&T and Transco.

www.wipro.com

© Copyright 2002. Wipro Technologies. All rights reserved. No part of this document may be reproduced,
stored in a retrieval system, transmitted in any form or by any means, electronic, mechanical, photocopying,
recording, or otherwise, without express written permission from Wipro Technologies. Specifications subject
to change without notice. All other trademarks mentioned herein are the property of their respective owners.
Specifications subject to change without notice.

12  Wipro Technologies