TSP Lab	Sga-7N-3 - The SS7 Remote Capture module	Sga-7N-3

The SS7 Remote Capture module
`("Sga-7N-3")`

Features
Basic operation
User interface
Auto logout feature
Configuration
Version history

Features

Captures signaling messages from the monitor unit(s)
There is an authentication process to control the rights for accessing signaling messages
Capturing can be filtered for a time interval
Filtering also can be done based on MTP/SIO and point codes
FISUs and/or LSSUs can be discarded
One or more signaling links can be selected to be captured
Size of the output file can be limited
Available time interval of signaling messages on the monitor unit can be queried
Can capture data either from Sga-7N or Sga-8N or both systems, simultaneously
GPRS data is also captured in SGA file format - with all of its benefits
Optional omission of IP and SCTP layers
DSS1 messages can be captured optionally with Interface ID and Circiut reference valure filtering
Capturing optionally with four IP address filtering fields

Basic operation

Connects to the Sga-7N and/or Sga-8N servers giving a username and a password for authentication (IP addresses of the servers can be adjusted in the configuration (Sga-7N-3.ini) file)
Gets sl.dat files from the servers after a successful authentication
Uses sl.dat information to determine which link belongs to which monitor
Connects to the monitor directly to get signaling messages from it

User interface

The Remote Capture module can be started by double clicking on its icon (as usual in Windows environment).
First the User Authentication window appears where it is needed to type a username and the password for this username. In addition it must also give a reason why the user wants to use this module. User also has to select which monitoring system he/she wants to use. After a successful log in user must choose his/her roles to decide which privileges he/she wants to use. If Apply default roles is checked user automatically use his/her default roles (defined on the servers in the authentication servers module). A 'super user' automatically logs in as a normal user when "Apply default role" option is checked.
Warning: In case of any problem during connection, please also consider local firewall problems and check the proper server IP address setting!

After the successful authentication the main window appears:

The parts of the user interface

Remote Monitor unit’s signaling link…
- …name: From this list the link generated from sl.dat file can be selected of which SS7 messages needs to be remote captured
- MULTIPLE!: When more links need to be captured check this checkbox and in the appearing Signaling links window it can be choose which links are to be get together:
  - In this window a group of signaling links can be selected by holding the Shift key and marking the first and last link with the mouse or they can be marked separately by holding the Ctrl key and clicking on the needed links by the mouse (as usual in Windows environment)
  - Filter1a and Filter1b: Two logically AND'ed filters for signaling link names. At most 20 characters can be defined.
  - Filter2a and Filter2b: Logical connection between these two filters and the previous ones is OR. At most 20 characters can be defined.
    - Search patterns can match anywhere within link names.
    - The usual wildcard characters can be used in the searching patterns. Search/filter expression wild chars with their respective meanings are the following:
      - '.' - matches zero or one character
      - '?' - matches one character
      - '*' - matches zero or more character
  - Select All: All signaling links are selected from the list
  - Clear All: All signaling links are deselected
  - Save Profile#N: There is a possibility to save four different selections of the signaling links.
    Name can de defined for each profile. By clicking into the grey name field it becomes editable.
  - Load Profile#N: Saved selections can be loaded with these buttons
  - Sga-7N: Only signaling links of Sga-7N system will be depicted
  - Sga-8N: Only signaling links of Sga-8N system will be depicted
  - both: All signaling links will be displayed from both systems
Record Interval…
- Only that SS7 messages are captured of which time is between …from and …to value
- !: This button fills the time fields with the actual date and time
- End time of record interval must be beyond the start time
Filter PDUs based on their IP addresses options
- PDUs are filtered based on the given IP addresses.
- Input fields next to each other are in logical 'AND' connection, i.e. if both fields are set then both one must be present in a PDU as the source or as the destination IP address.
- Criterias in the two rows are in logical 'OR' connection
Filter MSU's based on their...
- If "Show DSS1 specific labes above & below" is unchecked
  - SIO: Pressing this button the SIO based filtering rules can be set in a new window
  - Orig/Dest Point Codes (O/DPC): When this checkbox is checked only messages with the given point codes will be captured
  - Circuit Identifier Code (CIC): For ISUP messages a circuit identifier code based filter can be defined (if the checkbox is checked)
- If "Show DSS1 specific labes above & below" is checked
  - [N/A]: This button is not applied during DSS1 capturing
  - Interface ID / DSS ID: When the checkbox is checked and the DSS1 messages have been recorded from IUA links 'Interface ID' field should be filled with the "Interface ID" parameter; if messages are from LAPD links this field should be the DSS1PC (from the monitor configuration) and the 'DSS ID' field should be filled with 16383;
  - Call reference value: When the checkbox is checked the search brings messages with the given Circiuet reference value
Omit all...
- If "Show DSS1 specific labes above & below" is unchecked
  - ... Fill-in Signal Units (FISU): By checking this the output file will not contain FISUs
  - ... Link Status Signal Units (LSSU): LSSUs will be discarded from the output file
  - ... GTP-U packets from GTP capture: Only GTP-C packets will be captured
  - ... OPTIONS dialogs from SIP capture: OPTIONS dialog related messages will be left out
  - ... IP and SCTP layers: Protocol layers below M3UA will not be captured, only M3UA messages will be transferred
- If "Show DSS1 specific labes above & below" is checked
  - ... Receive Ready (RR) signal units: By checking this the output file will not contain RR messages
  - [N/A]: not used at DSS1 capturing
  - ... GTP-U packets from GTP capture: Only GTP-C packets will be captured
  - ... OPTIONS dialogs from SIP capture: OPTIONS dialog related messages will be left out
  - ... IP and SCTP layers: Protocol layers below M3UA will not be captured, only M3UA messages will be transferred
Save remote data locally as…
- Local filename can be defined with its full path
- Browse: The target file can be selected (if this is an existing file) by browsing the whole local filesystem
- View: This button provides a shortcut to the decoder (if there is assigned one to SGA files). When it is pressed the decoder automatically opens with the selected SGA file in it
- Stop when received more than X bytes: The capturing is stopped when the size of received messages reaches the limit of X
- Merge results into a single file: When more than one signaling link is selected to be captured messages can be saved into only one file
- Save into multiple files per signaling links: Multiple files will be created based on signaling links
- Save into multiple files per Monitor units: Multiple files will be created based on monitor units
Connection status
- Indicates the connection status during the capture process
Connect/Disconnect
- Establishes and interrupts remote capture connection to the selected monitor
Time?
- Gets the time interval available for the selected link
- Gets the current time on the monitor unit monitoring the selected link
Copy: If checked the answer of monitors for "Time?" query is copied to the clipboard.
Restart
- Stops and starts again the Remote Capture module with four options
  - Re-authenticate with the same user info: Restarts the module and logs in with the same username/password/reason values
  - Reload signaling link data: Without restart it request again the SL.dat information (for example when information was changed at the server)
  - Logon as a different user: Logs out and gives the authentication window again to log in with a new user
  - Logon with a different reason: Gives the authentication window to type the new reason for logging on

Auto logout feature

When there is no active remote capture request in progress for a given amount of time (for example 60 minutes) then the module automatically logs the user out. In that case the following pop-up window appears.

Configuration (`Sga-7N-3.ini`) file settings

This file has to be placed in the Windows or Winnt directory! Only keys that are described below can be changed by the user.
The other keys are used for saving local settings and filled by the program.
Before changing these keys below the Remote Capture module has to be closed.

Section Entry Example Meaning
[Authentication]
sUserName username Default username which appears in the username field of the User Authentication window. User can change it here or in the User Authentication window.
[Advanced]
sPollerIPAddress 111.22.33.44 The server IP address where the Sga-7N authentication server module is running. (Typically it is the same where the Poller module is running)
sPollerIPAddress-8N 111.22.33.45 The server IP address where the Sga-8N authentication server module is running.

Section	Entry	Example	Meaning
[Authentication]
	sUserName	username	Default username which appears in the username field of the `User Authentication` window. User can change it here or in the `User Authentication` window.
[Advanced]
	sPollerIPAddress	111.22.33.44	The server IP address where the Sga-7N authentication server module is running. (Typically it is the same where the Poller module is running)
	sPollerIPAddress-8N	111.22.33.45	The server IP address where the Sga-8N authentication server module is running.

Version history

v2.39

(c) Can handle 9000 signaling links at most.

v2.30

(c) Flexible remote TCP port received in the SL.DAT (instead of the built in 7003 and 8003)

v2.28

(c) Increased the maximum PDU size in all sub-modules from 4000 to 8000 bytes.

v2.27

(c) Length of a password can be at most 31 characters.

v2.26

(c) End time of record interval is checked and must be beyond the start time.
(c) SigLink search/filter expressions can now be up to 80 characters.
(c) Default IP address for Sga-8N authentication module changes from "10.244.250.51" to "10.117.114.162".

v2.25

(n) Wildcard characters can be used in SigLink filters.
(c) Error message when connecting to the SGA-7N server is revised to draw attention to a possible local firewall problem.
(c) Super users automatically log in as normal users when "Apply default role" option is checked in the User Authentication window.

v2.24

(n) Handling of user superability.
(c) Layout redesign.
(c) Four IP addresses can be defined for filtering.
(c) SGA-7N SigLink info is no longer cached between logon sessions.
(n) "Time?" indicates time data both as GMT as well as local time.
(c) The final second of the record interval set is excluded (used to be included).
(c) Very old Monitor versions are no longer supported.

v2.23

(c) Speed-up data capturing and output file writing.
(c) "Omit sub-M3UA layers" text changed to "Omit IP+SCTP layers".
(c) Size of "Stop when save more then ... bytes." input field increased.
(c) "Time?" result dialogue box is redesigned.

v2.22

(n) Legacy and Active Directory authentication methods are both available.
(c) If more than 9 Monitor units are to be queried for "Time?", then suggests the "Copy" option to be checked instead of displaying several individual message boxes.

v2.21

(c) If "Copy" option is checked, then no individual message boxes are displayed for "Time?" query.
(f) Used to fail if too many signaling links were queried for "Time?".

v2.20

(c) Can handle 5000 signaling links at most (instead of the former limit of 3000).

v2.19

(c) Module is restored if iconized when inactivity time-out expires.
(c) Logging of a huge amount of selected links is considerably faster.

v2.18

(c) Now every filter setting is logged.

v2.17

(c) Slight changes in Auto-LogMeOut feature.

v2.16

(n) Auto-LogMeOut feature to fulfill security regulations.
(n) Logs query results.

v2.15

(c) "User Name" and "Password" input fields of User Authentication window are limited to 20 characters.
(c) "Reason" input field is limited to 100 characters.
(n) Logon using "ActiveDirectory" method.

v2.14

(f) Might have crashed after capturing long MSU's

v2.13

(n) Option for capturing SIP messages: "Omit all OPTIONS dialogs from &SIP capture".
(c) Tab window heading "not-GTP" and "GTP" are renamed as "SS7 & DSS1" and "GTP & SIP", respectively.
(n) INI/[Settings]/bSIPFilter

v2.12

(c) Application specific warning text became optional for either (7N and 8N) systems.
(c) If invoked from ISUP_CDR Query, ISUP and BICC are selected as SIO filters (used to be ISUP only).
(c) If invoked from ISUP_CDR Query with DSS1 data, filter check boxes are filled accordingly.
(c) In case of DSS1 capturing InterfaceID is masked properly.

v2.11

(n) Authentication process is extended with showing an application specific warning text along the previous successful action's date and, if any, the previous bad login's date (and also the count). The user is required to explicitly accept (confirm, acknowledge) these terms in either or both systems to be used.
(c) Uses application code 7033 for authentication in both systems.

v2.10

(c) New design: tabbed window separating non-GTP and GTP capturing.
(n) GTP capturing optionally with two IP Address filtering fields (AND'ed).
(n) INI/[Settings]/byTraceBasedOn

v2.03

(n) "Show DSS&1 specific labels below" check box; saved at exit, reloaded at start-up.
(c) "Omit all ..." and "Filter ..." groups can optionally show DSS1-specific labels.
(c) "Orig/Dest Point Codes (O/DPC)" and "Circuit Identifier Code (CIC)" edit boxes have their space extended for 5 digits.
(n) INI/[Settings]/bDSS1Labels

v2.02

(n) Option to omit all sub-M3UA layers
(n) INI/[Settings]/bM3UAFilter (defaults to 1, i.e., filter is set)

v2.01

(n) Destination address is also shown in "There was an error connecting to the SGA-xN server" error message dialog.
(c) Default IP address for Sga-7N authentication module becomes "10.117.114.103".
(c) Default IP address for Sga-8N authentication module becomes "10.244.250.51".
(f) Copy-to-clipboard feature with "Time?" request failed if multiple signaling links involving too many monitor units were selected.

v2.00

(n) Can capture data either from Sga-7N or Sga-8N or both systems, simultaneously.
(c) GPRS data is also captured in SGA file format - with all its benefits.
(n) Login dialog has been redesigned to handle various cases.
(c) Uses application code 7023 for authentication in both systems.
(c) SL.Dat cache is no longer used.
(f) Restart clears multiple signaling link selections.
(n) Multiple signaling link selection filters have OR and AND options.
(n) Multiple signaling link selection can filter for Sga-7N, Sga-8N or both links.
(n) "Copy (answers to clipboard)" under "Time?" button.
(c) Log window became slightly wider.
(n) INI/[Authentication]/byUseSystem
(n) INI/[Advanced]/sPollerIPAddress-8N
(n) INI/[Advanced]/bTimeCopy

v1.51b

(n) INI/[Debug]/wRemotePort (defaults to 7003 for compatibility)
(n) INI/[Debug]/bReceiveOnly (defaults to 'False' for compatibility)

v1.51

(n) Capability of capturing GTP packets, with the simplest GTP-U filter control.
(n) INI/[Settings]/bGTPUFilter

v1.50

(c) Outputs "SGA" files instead of former "DSP" files, handling any new types of data (e.g., SigTran) returned from the new Monitors as well.
(c) Merging and separation are completely rewritten to handle SGA files; former (when "Single file" is selected) is much faster, latter (when "Multiple file per signaling links") is much-much faster now.
(n) Full link name is also encoded into the output file.
(c) "View" function uses Windows shell associated 'open' procedure instead of hard-wired invocation of the "Sga-7w" decoder.
(n) Shift-ESC combination minimizes application window.

v1.25

(c) Patch to overcome a Monitor SW problem with infinite end-time setting.

v1.24

(c) Updated spare SIO filter names.

v1.23

(f) Used to write tiny empty files in case of "Time?" query with multiple links set.

v1.22

(c) "Per-Monitor" capturing (used to be "per-SignalinkLink" capturing); it is much more efficient if multiple links reside on the same Monitor unit.
(n) "Save into multiple files" can be requested either "per signaling links" or "per Monitor units".
(n) From and To time settings are shown in log window (as well as active SIO filtering).
(c) Empty files are deleted at the end of capturing, except in case of "per-SignalinkLink" capturing.
(n) Multi-line selection log window, with copy-to-clipboard functionality.

v1.21

(n) Roles are introduced (requires SGA-Authorizer v1.07 or above on server side).
(n) Actually chosen role is logged (locally and remotely) at start-up and at restarts as well.
(n) Authentication dialog contains "Apply default role" option; its state is saved between sessions.
(n) INI/[Authentication]/bApplyDefaultRole
(c) Note for administrators: OraclePassword field is sent in the monitor request, instead of the former OracleUserName!

v1.20

(c) Error message when connecting to the SGA-7N server is rearranged to make it more visible.

v1.19

(n) Can capture (and merge) MSU's from HSL and 64 kbps SS7 signaling links as well
(n) New checkbox: "Omit all Fill-in Signal Units (FISU)" (in new Monitor versions)
(n) New checkbox: "Omit all Link Status Signal Units (LSSU)" (in new Monitor versions)
(c) Number of Multi-link selection profiles is incremented
(n) Two powerful filters in Multi-link selection dialog (logically AND'ed, case insensitive)
(n) Status display about actual filtering and selection counts
(n) Multi-link selection profiles can be named
(c) Hotkey for "Select All" in SIO filter and in Multi-link selection dialogs is changed for Alt-A (used to be Alt-S)
(c) Cursor changes to hourglass-shape while merging DSP files
(n) INI/Settings/bFISUFilter (defaults to False)
(n) INI/Settings/bLSSUFilter (defaults to False)
(n) INI/[MultiSL Profile Names]/#{1..5} (defaults to "(name not set)")
(n) INI/[MultiSL Profile #5]
(n) Output DSP file version is set to v1.04 if HSL data is included (for decoder down- and upward compatibility)

v1.18

(c) Handled in Sga-Authorizer with application ID 7013; used to be 7003.

v1.17

(n) Requires a "Reason" be given at authentication.

v1.16

(c) Forwards Oracle user name (provided automatically during authentication) to the Monitor units to indicate USSD and SMS display rights.

v1.15

(n) User activity is logged.
(n) Restart facility with various options.
(n) INI/[Advanced]/sPollerIPAddress (defaults to 10.4.1.152).
(f) Used to start capturing on module restart in case of multi-SL selection switched on.

v1.14

(c) Can handle 3000 signaling links at most (instead of the former limit of 1000).

Known bugs

No bug is known at present.

The SS7 Remote Capture module("Sga-7N-3")

Table of Contents