You are here

Home › Forums › Telecom › SS7

MAP mensage

9 posts / 0 new
Log in or register to post comments
Last post
Sat, 01/28/2012 - 19:42
#1
Vitorino
MAP mensage

Hi, guys!
I need help with one mensage that still I dont know what is. I caught this mensage in nokia's HLR (service terminal). Maybe is one MAP or CAP mensage. Anybody can help me with the bellow mensage and your parameters?

hugs!

CALLER : 0114 0000 00 RETURN ADDRESS: 000C (L0001).0000434A
WRITE TIME: 2012-01-26 16:19:28.62
PARAMETERS: E-07 0014.000000B8 00000096 0014.00000085
USER TEXT : 0B0D: RECEIVED ERRONEOUS MSG FROM NETWORK
USER DATA : CB 00 4C 44 08 02 00 00 00 09 8A 00 31 D3 44 00
00 00 00 00 C8 20 00 00 5D 2F 00 00 80 00 00 00
01 00 08 00 00 00 00 00 13 00 5D 2F 00 00 08 FF
FF FF FF 00 00 0A 00 26 00 90 00 09 00 01 00 06
00 00 00 00 01 1B 00 05 00 06 00 00 00 00 01 04
01 00 01 04 0C 05 05 00 03 01 02 00 00 03 00 02
00 68 00 64 66 49 04 18 00 0C 66 6B 2A 28 28 06
07 00 11 86 05 01 01 01 A0 1D 61 1B 80 02 07 80
A1 09 06 07 04 00 00 01 00 0E 03 A2 03 02 01 00
A3 05 A1 03 02 01

Top
Mon, 01/30/2012 - 12:34
TomiZet
sendAuthenticationInfo

Hi Vitorino,

this hexa dump represents sendAuthenticationInfo msg. If the dump is complete problem is the last byte is missing:
A1 -> tag
03-> length
02 01 -> value

Problem - the length of the value does not correspond to the length one line above. ASN.1 decoder can not decode this element and so message/operation can not be handled.

Top
Wed, 02/08/2012 - 03:23
(Reply to #2)
Vitorino
MAP message

Hi TomiZet,
Pls, I need to understand the parameters this message.
Where I find, in this msg, the OPC, DPC or SSN the involved elements?
Sorry, but I don't know when and where start and terminate the parameters, because the format of msg isn't the same in my protocol analyser.

Thanks!

Top
Fri, 02/10/2012 - 18:46
(Reply to #3)
TomiZet
MAP msg over SUA??

Hi Vitorino,

I am not so familiar with SCCP but anyway I could not figure out vaild SCCP data in the dump - I guess you are using SUA then... I can tell you where the MAP data begin and with the knowledge about underlying protocol you can try to get information about GT.
MAP data begin with pattern 64 66 49... The dump is not complete, because overall length of MAP data was 68->102 bytes but dump stopped at the tag which caused decoding problems..

USER DATA :
CB 00 4C 44 08 02 00 00 00 09 8A 00 31 D3 44 00
00 00 00 00 C8 20 00 00 5D 2F 00 00 80 00 00 00
01 00 08 00 00 00 00 00 13 00 5D 2F 00 00 08 FF
FF FF FF 00 00 0A 00 26 00 90 00 09 00 01 00 06
00 00 00 00 01 1B 00 05 00 06 00 00 00 00 01 04
01 00 01 04 0C 05 05 00 03 01 02 00 00 03 00 02
00 68 00 64 66 49 04 18 00 0C 66 6B 2A 28 28 06
07 00 11 86 05 01 01 01 A0 1D 61 1B 80 02 07 80
A1 09 06 07 04 00 00 01 00 0E 03 A2 03 02 01 00
A3 05 A1 03 02 01

64 TC-END
66 Total message length
49 Destination Transaction ID Tag
04 Transaction ID Length
18 00 0C 66 Transaction ID Value
...etc...


Top
Sat, 02/11/2012 - 03:15
Vitorino
MAP Message

Hi TomiZet,

Thanks for clear up this question. I compared the transation id field in this message with the messages collected with the protocol analyser.

Thanks a lot!

Top
Wed, 02/29/2012 - 08:09
thyraell
@tomizet : your knowledge

@tomizet : your knowledge about hexa dump trace is damn good,.can you tell me where to get the guidance for another signaling trace messages?

Kind Regards

regards,

thyraell

follow me on twitter : @llearyht

Top
Wed, 02/29/2012 - 11:11
TomiZet
I am not sure what kind of

I am not sure what kind of guidance you are seeking.. may I ask you to describe in more details (perhaps describe with some examples) what you would like to get to know?

Top
Thu, 03/01/2012 - 02:43
thyraell
Hi, Just the reference to

Hi,

Just the reference to read signaling trace in hexadecimal format.,

Regards

regards,

thyraell

follow me on twitter : @llearyht

Top
Thu, 03/01/2012 - 07:48
TomiZet
Well, I do not know if there

Well, I do not know if there is any.. I parsed the dump simply based on the knowledge of TCAP/MAP ASN.1 BER.. The thing is to find some anchor point in the dump.. This is quite easy in case you know TCAP message bears MAP message - you can search for the [url=http://www.obj-sys.com/asn1tutorial/node124.html]OBJECT IDENTIFIER tag[/url] and see where it matches some MAP ACN.. In this case the sequence of bytes 06 07 04 00 00 01 00 0E 03 is what we are looking for:

06 OBJECT IDENTIFIER tag
07 OBJECT IDENTIFIER tag length
04 00 00 01 00 0E 03 OBJECT IDENTIFIER tag value == ACN for service sendAuthenticationInfo MAPv3

From there you can browse TCAP/MAP message up and down because it is entirely build up TLV-way (Tag,Length,Value). This would not work for MAPv1 since there ACNs are not used but you would apply similar principle on another mandatory tag..

Top