https://s14.postimg.cc/p7r8mm3k1/reykjavik-1724643_640.jpg Source: [Pixabay](https://pixabay.com/en/reykjavik-business-phone-1724643)

So far the reader has been introduced to the architecture of a GSM mobile operator's network and learn about the concepts of logical channels, circuit switched (CS) attachment and authentication/ciphering. Let's now turn our attention to a real service provided to the subscriber, voice calls. We will examine how mobile operator route calls within the network and how network resources are setup to transport audio end to end. ## Signalling and User Traffic In mobile network jargon there are two types of packets exchange between UEs and the network: **signalling** and **user** traffic. The user traffic is the exchange of packets actually produced or consumed by the subscriber. For voice calls this user traffic consists of the audio stream produced/consumed by the microphone and the speaker/earphone. For data service, the user traffic would consists of IP packets exchanged between the handset and the Internet. The signalling traffic is the exchange of packets used to setup the network resources required for providing services to the subscribers. In the case of voice calls the signalling traffic is used (mainly) to route the call to its destination and setup the network resources required for the transport of user traffic. One key concept to understand is that signalling and user traffic are treated independently in the network. This is because the service requirements of these traffic types are usually widely different. For example, signalling traffic normally requires best effort but reliable transmission of packets while audio user traffic needs to be delivered on a timely basis but can suffer a certain degree of packet loss. In other words the constraints on the network are completely different between the two types of traffic. https://s14.postimg.cc/ulq0tviwx/cp_and_up.png Source: Original illustration for Steemit Imagine a call placed between two UEs. For the above reasons the path taken by the signalling traffic to connect the call can be completely different than the path taken by the audio traffic as illustrated above. ## Phases of Call Establishment For simplicity reasons we will now look at call establishment between two UEs from the caller point of view and the called party point of view. The former is referred to as mobile originated (MO) call while the latter is referred to as mobile terminated (MT) call. For a successful MO call the different phases are usually as follows: https://s14.postimg.cc/9q3qj2pf5/mo_call_1.png Source: Original illustration for Steemit * Caller dials the called party number and initiates the call. * UE sets up logical channels with the BTS/BSC for transmission of signalling and user traffic. * BSC passes on call setup request to MSC/VLR. * MSC/VLR checks caller is authorized to place the call the called party. * MSC forwards the call establishment to the called party's network gateway MSC. * Gateway MSC iniatied MT call to called party * Call progresses to the alerting state. Usually this means the called party's handset is ringing. * The called party's network indicates that the call has been answered. * Audio flows as user traffic between the caller's handset and the called party's network. A successful MT call looks like this: https://s14.postimg.cc/3k6vpk5ap/mt_call.png Source: Original illustration for Steemit * Gateway MSC of the called party receives an incoming call notification. * Gateway MSC interrogates the HLR to find out the VLR in which the called party is currently registered in. * HLR returns the ISDN number of the VLR * Gateway MSC requests a temporary roaming number from the VLR. This is an ISDN number currently not in use and managed by the co-located MSC. * VLR allocates free roaming nbr and returns it to Gateway MSC. * The Gateway MSC places a call to the roaming number previously allocated by the VLR * When the call is received by the MSC on the roaming number, it checks with its VLR to see if the call should proceed to the called UE or otherwise (for example, call forwarding is enabled). * Assuming that the called party is idle, the MSC pages the UE. * The UE sets up logical channels with its BTS/BSC. * The call setup request is sent to the UE. * The UE starts ringing * The subscriber answers the call and audio flows in both directions. We will examine in more details the call establishment procedure in the next post. ## A Note about Procedure Routing in the Network An introduction of mobile networks wouldn't be complete without explaining how procedures get routed to the correct network elements. One thing to remember is that telephony packet networks pre-dates the days when IP networks (such as the Internet) became widely used. In those days telephony networks, and by extension mobile networks, were mostly using a protocol stack specialized for voice, messaging and management applications known as [Signalling System No. 7](https://en.wikipedia.org/wiki/Signalling_System_No._7). SS7 network in itself could be the subject of many posts but let's try to keep it really simple and focus on what the reader needs to know to understand the rest of this article. SS7 networks work on a protocol stack that has some similarities to the IP stack used in modern networks. For example in SS7 each host is given a unique numerical address, called a **point code**, which is the equivalent of an IP address on the Internet. Applications and users of the SS7 network can be addressed through separate ranges of digit sequences referred to as **global titles**. In essence, a global title is a particular type of addressable number. For example, a phone number, such as +353 1 123 4567, is a global title with a type standardized in the [E.164](https://en.wikipedia.org/wiki/E.164) ITU specifications which defines how the number is made of an international country code (353), a national destination code such as a regional code (01) and a subscriber number number (123 4567). https://s14.postimg.cc/9gns9ob8h/e164.png Source: Original illustration for Steemit E.164 numbers are commonly referred to as ISDN numbers because they used to identify subscribers and functions of ISDN networks. By extension each subscriber of a mobile network is given a unique MSISDN (Mobile Station ISDN number). The MSISDN is what non-technical people refer to as "mobile number". Another type of global title is a number of type [E.212](https://www.itu.int/rec/T-REC-E.212/en) which is none other than the IMSI that uniquely identifies a subscriber in mobile networks. There are other types of global titles but we will concentrate on the two types mentioned above: MSISDNs (E.164) and IMSIs (E.212). As you may know, in IP networks multiple applications may be sharing the same IP address. In order to address a specific application the IP protocol stack uses the concept of port number. The most commonly used of port numbers are TCP and UDP port numbers. In a similar way multiple SS7 applications may use a single point code. For this reason SS7 introduces the concept of *subsystem number* (SSN) which is the equivalent of port number in IP networks. SS7 applications are thus addressable through a pair of point code and SSN values. Using the SSN it is possible, for example, to have an MSC and a VLR residing on the same host and sharing the same ISDN number / point code. In SS7 networks global titles are used in a similar way as host names in IP networks and need ultimately to be resolved into point codes using a process called Global Title Translation (GTT), which by some analogy would be the equivalent of a DNS resolution procedure. ### Routing Procedures over SS7 In previous posts we have learned how a location update procedure involves the VLR of the visited network notifying and retrieving subscriber information from the HLR. But how does the VLR gets to route the procedure to the correct HLR? Bear in mind that the subscriber may be roaming and in this scenario the VLR and HLR would belong to different mobile operators, likely in different countries. To understand how this works we need to remember that the only piece of information that the VLR has is the IMSI of the subscriber. Well, the IMSI is standardized to be a 15 digit sequence of digits with the given structure: * 3 digits corresponding to the mobile country code (MCC) of the subscriber operator, followed by * 2 or 3 digits corresponding to the network code (MNC) of the susbscriber operator, followed by * 9 or 10 digits having local significance within the subscriber operator's network. The key here is that the IMSI contains enough information to route the procedure to the correct operator's SS7 network to any country in the world. Let's take an example. Let's assume a US Verizon subscriber roams onto an Irish network. The Verizon subscriber will have an IMSI which will look like 311275xxxxxxxxx because the US mobile country code is 311 and (one of the) Verizon mobile network code is 275. When processing the incoming location update procedure the VLR of the visited network establishes a transport connection to the subscriber's HLR through its nearest suitable Signal Transfer Point (STP). An STP is router in charge of routing telephony traffic over SS7 networks. The STP primary role is to find the best suitable route to a destination. In the above example the VLR uses the IMSI as global title in the destination address of the connection request along with the well known HLR SSN. The STP retrieves the point code of another STP acting as gateway for the destination country (US) and forwards the connection request to that STP. The country code of the destination country was exctracted from the IMSI global title as described above. The STP in the subscriber home country now extracts the network code from the IMSI and looks up its routing table for the point code of the operator's gateway STP. It then forwards the request to that STP. The subscriber mobile operator's STP receives the connection request addressed to a particular IMSI and for an HLR. The operator's STP determines the point code of the correct HLR and forwards the connection request accordingly. The HLR receives the connection request, sends back a connection response and the procedure between the VLR and the HLR continues until completion. The end to end transport connection is then released once the procedure completes. The above example is somewhat a simplification of how such procedure would be routed in real life but it gives a good overview of the general principles. ## Voice Codecs A codec is a program dedicated to encoding/decoding a media source into a different format. Voice codecs are specialized forms of codecs whose task consists in transforming an input media stream consisting of human voice into a different output media stream suitable for delivery over the network. In cellular networks the voice codecs are specialized to deliver audio over radio channels with small bit rates, typically under 16kbs. Compare this with MP3 formatted audio which commonly uses anywhere between 128kbs and 320kbs. Because of these tight bandwidth restrictions voice codecs highly compress the audio stream and are heavily optimized to efficiently process human voice, discarding most frequencies outside the usual voice range. In today's cellular networks the voice codec of choice is the Adpative Multi-Rate (AMR) codec. As its name suggests AMR is a codec whose bit rates can change (adapt) based on the current transmission conditions of the network. In order to do this the receiver end of an AMR audio stream can feedback error bit rate and packet loss information to the sender, allowing the sender to switch to lower/higher bit rates accordingly. An AMR packet contains two parts: bits encoding the audio itself and bits used for error detection/correction. The lower bit rates offer better error detection/correction but higher audio compression resulting in lower audio quality. AMR is available in narrow-band or wide-band form. Narrow-band AMR samples the audio into 8Khz units. Wide-band AMR samples audio into 16Khz units resulting in higher quality but usually higher bit rates. In 1999 3gPP adopted AMR as the standard speech codec for cellular networks but sadly the codec itself is subject to patents and royalties. This caused this great technology not to be widely adopted in other industries such as enterprise PBXs, VoIP providers, etc.# Because of this AMR encoded audio usually needs to be transcoded into other formats (such as A-LAW, G.722, etc) before delivery to non-cellular equipment. Transcoding is a processing intensive operation and therefore increases the cost of switching voice traffic. In my mind this is one of the biggest let-down of 3gPP, driven by commercial greed. ## Media Gateways Finally let's have a word about media gateways (MGWs). We saw earlier in this post that the signalling traffic and user traffic are handled separately in the network. When a network element such as a BSC or an MSC becomes aware of a new user traffic stream (such as an audio stream), it must instruct the network element in charge of processing this user traffic stream to switch the stream from a given source to a given destination. As indicated below there may also be a need to instruct the MGW to transcode the audio stream if the receiving party cannot understand the input stream (e.g. AMR rarely supported by a VoIP provider). The diagram below illustrates how the user plane for an audio call would be typically setup for a GSM voice call to the Public Switched Telephone Network (PSTN). https://s14.postimg.cc/dzwckitzl/mgw.png Source: Original illustration for Steemit ---------- ## What Next? In this post the reader has received an overview of the different phases involved in connecting a voice call between two mobile users. A basic introduction to procedure routing over SS7 networks was given with an example involving the VLR initiating a location update procedure with the correct HLR. In the next post we will put all this information together and examine in a reasonable amount of details the procedures involved in connecting a mobile originated call, including setting up the user plane for proper audio transmission. ---------- ## Acronyms and Concepts |Acronym|Meaning|Description| |--|--|--| |AMR|Adaptive Multi-Rate|Speech codec officially adopted by 3gPP in 1999| |CP|Control Plane|Medium carrying signalling traffic| |HLR|Home Location Register|Stores all subscriber information such as IMSI, access and service rights, location information, etc.| |IMSI|International Mobile Subscriber Identity|15 digits number uniquely identifying a mobile network subscriber across all providers| |MGW|Media Gateway|A network entity mainly responsible for switching and transcoding audio user traffic| |MO call|Mobile Orginated call|Call places from a UE| |MSC|Mobile Switching Centre|Responsible for servicing all CS application procedures (mobility, messaging, voice calls, etc), switching calls with external telephony networks and forwarding SMSs to Short Message Service Centres (SM-SC)| |MT call|Mobile Terminated call|Call received by a UE| |PLMN|Public Land Mobile Network|An operator providing mobile telecommunication services| |SIM|Subscriber Identity Module|A type of UICC fitted within mobile network terminals (e.g. handsets). Responsible for storing important and sensitive information and capable of processing instructions, including authentication algorithms| |SS7|signalling System No. 7|Network infrastructure in legacy telephone networks| |UE|User Equipment|Terminal used by the subscriber to access the mobile network, such as smartphone, modem, IoT device, etc.| |UP|User Plane|Media carrying user traffic| ## References * [Mobile Application Part (MAP) specification (3GPP TS 29.002)](https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1585) * [Mandatory Speech Codec speech processing functions; AMR Speech Codec; General Description (3GPP TS 26.071](http://www.3gpp.org/ftp/Specs/html-info/26071.htm) * [ITU-T Recommendation Q.700](http://www.itu.int/rec/T-REC-Q.700/en) * ["ITU-T The International Public Telecommunication Numbering Plan"](https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-E.164-201011-I!!PDF-E&type=items) * [World Telephone Numbering Guide](http://www.wtng.info) ## Previous Posts in this Series [Introduction to Mobile Networks](https://steemit.com/mobilenetworks/@irelandscape/introduction-to-mobile-networks-1520627562-1015441) [The GSM CS Architecture](https://steemit.com/mobilenetworks/@irelandscape/introduction-to-mobile-networks---the-gsm-cs-architecture-1520805693-9925182) [GSM CS Attachment](https://steemit.com/mobilenetworks/@irelandscape/introduction-to-mobile-networks-gsm-cs-attachment) [Security in 2G (GSM) Networks](https://steemit.com/mobilenetworks/@irelandscape/introduction-to-mobile-networks-security-in-2g-gsm-networks) [3G (UMTS) Authentication](https://steemit.com/mobilenetworks/@irelandscape/introduction-to-mobile-networks-3g-umts-authentication) **As always do not hesitate to leave comments with your questions and I will make sure to reply with the best possible answers.**