Monitoring MTP2 errors with sliding windows and burst detection
MTP2 error monitoring gives SS7 operators an early view of signalling-link health before faults become failed calls, delayed SMS messages or widespread routing instability. A simple daily error percentage is rarely enough. The useful picture comes from combining protocol counters, short observation windows and the timing pattern of invalid signal units.
This is especially relevant where legacy SS7 links connect to SIGTRAN gateways and IP transport. Australian carriers may have signalling paths spanning Sydney, Melbourne, Brisbane and regional sites, with very different latency and transmission conditions. A disciplined monitoring method helps separate a noisy physical link from congestion, configuration errors and deliberate disruption.
What MTP2 is measuring
MTP2 carries signalling units across a point-to-point link and provides delimiting, sequence control, acknowledgement and retransmission. It uses forward and backward sequence information to keep signal units in order, while error detection identifies frames that should be discarded. The link then attempts recovery through retransmission and link-control procedures.
Useful measurements include received signal units, errored units, retransmissions, negative acknowledgements, proving failures and link alignments. Operators should also record the link state and the relevant timers. A rising error count while the link remains available may be an early warning; repeated transitions into alignment or proving states indicate a more serious service effect.
Why a sliding window is useful
A sliding window evaluates a moving group of recent observations rather than relying on a counter that resets once per day. For each window, calculate the error ratio as errored signal units divided by all inspected signal units. The window can contain a fixed number of units, such as 1,000, or represent a fixed period, such as 60 seconds.
A unit-based window is often better when traffic varies sharply between busy and quiet periods. A time-based window is easier to compare across links and dashboards. In either case, retain the previous window’s result so that the monitor can show whether the rate is accelerating, recovering or remaining elevated. A busy trunk between Melbourne and Sydney should not be judged by the same absolute error count as a lightly used regional link.
Detecting bursts rather than isolated errors
Random single-frame errors and concentrated bursts have different operational meanings. A burst may indicate electromagnetic interference, a failing optical module, a damaged cable, queue loss, a faulty gateway or an attack designed to destabilise signalling. The monitor should therefore track consecutive errors, errors per short time bucket and the longest gap between valid units.
One practical rule is to raise a burst event when several invalid units occur within a defined interval, even if the total sliding-window rate remains below the main alarm threshold. Another is to compare the current rate with a baseline for the same traffic period. This prevents a brief cluster during a quiet overnight period from being hidden by a large denominator.
The detector should include hysteresis. For example, an alarm may open after three qualifying bursts in five minutes and close only after ten minutes below the recovery threshold. This avoids repeated alarm flapping when a link hovers around a boundary.
Choosing thresholds and counters
Thresholds should reflect the equipment vendor’s implementation, the SS7 service level and the normal behaviour of each link. Record absolute counts alongside percentages, since a 10 per cent rate from ten received units does not carry the same evidence as 10 per cent from 10,000 units. Counters should also distinguish checksum or format errors from retransmissions and link-management failures.
| Signal | What it shows | Useful response |
|---|---|---|
| Sliding error ratio | Sustained quality degradation | Inspect transport, optics and link statistics |
| Consecutive invalid units | Short, concentrated interference or loss | Check burst timing and physical alarms |
| Retransmission rate | Recovery workload and possible delay | Compare with latency and queue data |
| Alignment or proving failures | Link instability or configuration fault | Validate parameters, clocking and cabling |
| Error rate by direction | Asymmetric impairment | Test each transmission path separately |
Use SS7 training materials to connect these measurements with MTP2 procedures, MTP3 routing and the wider PSTN architecture. A counter has meaning only when engineers understand which protocol action produced it.
Correlating MTP2 with SIGTRAN
An MTP2 alarm should never be interpreted in isolation when the signalling path includes an IP adaptation layer. M2PA or M2UA may expose link events differently from a traditional TDM span, while SCTP can introduce its own retransmissions, path changes and heartbeat failures. Collect timestamps from the signalling point, signalling gateway, SCTP association and underlying network.
Correlation is particularly valuable on Australian networks that use leased fibre, carrier Ethernet and diverse NBN or mobile backhaul services. If MTP2 errors rise without packet loss or SCTP path changes, inspect the span, interface and gateway. If both signalling errors and IP retransmissions increase, investigate congestion, policing, route changes or a shared transport fault.
Keep clock sources consistent and store raw event data long enough to compare incidents. Australian operations teams commonly work across Australian Eastern, Central and Western time zones, so dashboards should record UTC alongside local time. This avoids confusing planned maintenance in Perth with a fault appearing in Sydney.
Building an operational monitoring routine
A useful dashboard shows current rate, five-minute and one-hour trends, burst count, link state, retransmissions and related MTP3 availability. Alarm enrichment should identify the signalling link, point codes, affected direction, carrier circuit and whether alternate routing is active. Avoid exposing subscriber content; signalling metadata still needs careful handling under the Privacy Act 1988 and internal security controls.
Retention, access logging and incident handling should fit the organisation’s obligations under Australian telecommunications regulation and, where applicable, the Security of Critical Infrastructure Act 2018. Monitoring should also feed capacity and resilience reviews rather than remain a fault desk metric. A recurring burst at the same time each day may reveal a scheduled network activity or a recurring power and environmental issue.
Begin with one representative link: capture its MTP2 counters and link-state events for seven days, calculate a one-minute sliding error window, and add an alert for three bursts within five minutes.
