SCCP Called Party Address Decoding: Nature of Address and Digits
Engineers in Sydney reading international transit traffic see direct consequences from a misread Called Party Address field: calls misroute or reach the wrong mobile switching centre. Australian carriers using the 04 mobile prefix rely on this address to identify the right home location register before any ISUP voice path is established.
The Called Party Address carries three logical layers: the routing indicator, subsystem addressing, and the digit payload. Each uses a tight set of flags defined in ITU-T Q.713 and the ANSI variants, and a single misinterpreted bit can shift a translation from a Global Title query to point-code-only delivery. The hands-on material on Solutions treats the topic as a decoding problem rather than theory, the same approach used here.
Why the Called Party Address Matters in SS7 Signaling
SCCP sits above MTP3 and below the application layer, providing connectionless and connection-oriented services to subsystems like MAP, CAP, and RANAP. When a short message service centre in Brisbane queries a mobile switching centre in Perth, SCCP uses the Called Party Address to locate the destination without the full point code at every hop. This is what lets cross-carrier and international signaling scale without constantly updating routing tables.
The address also carries information that higher-layer protocols consume directly. Translation Type tells the destination which application should answer, while the Numbering Plan Indicator steers Global Title translation across E.164, E.212 IMSI, E.214 mobile global title, and locally administered numbering. Carriers handling domestic ISUP traffic mixed with Asia-Pacific inbound roamers see these plans interleaved on the same link set.
Anatomy of the SCCP Address Structure
The Called Party Address is variable length because both indicators and digit bytes are optional. The first byte, the Address Indicator, packs the Routing Indicator, Global Title Indicator bits, Subsystem Number flag, and Point Code flag. Only bits for fields actually present are set.
The digit payload follows, typically BCD encoded for E.164 numbers like 61412345678, where country code 61 identifies Australia. Each BCD pair stores two digits, with an odd leftover nibble padded as 0xF. Engineers reading hex captures from a Sydney-to-Singapore STP often mistake these filler nibbles for real digits.
Nature of Address Indicator Categories
The Nature of Address Indicator tells the network whether the digits represent a subscriber number, a national prefix, an international prefix, or a network-routing code. ITU-T defines 0x00 for unknown, 0x03 for national significant number, 0x04 for international number, and 0x06 for abbreviated codes. ANSI dialects overlap but use distinct numbering, a frequent source of cross-border tickets handled by Australian Tier-2 NOCs.
The NAI matters because the same digit string routes differently depending on how it is flagged. A 0477 prefix marked as national significant number lands at the local exchange in Melbourne, while flagged as international number it is sent through the Sydney international gateway. Verifying the indicator byte before reading digits prevents wasted debugging.
Numbering Plan and Encoding Schemes
The Numbering Plan Indicator identifies which international standard the digits follow. NPI 0x01 means E.164, 0x03 means X.121 for legacy data, 0x06 means E.212 IMSI, and 0x07 means E.214 mobile global title. Australia's Telecommunications Numbering Plan, made under the Telecommunications Act 1997, requires E.164 for consumer voice, so most Australian Global Titles show NPI 0x01 even when higher layers query IMSI.
Encoding is separate from numbering plan. BCD is the default, but the standard allows BCD-even, BCD-odd, and an ASCII scheme. Exchanges in Adelaide and Hobart upgrading their SCCP handlers selectively can still produce mixed encoding during transition windows. The schemes trade byte alignment against the cost of a trailing nibble going unused.
Step-by-Step Decoding Example
Walk through a representative address hex dump of 09 12 04 67 11 32 54 86 0F. The first byte, the Address Indicator, decodes as 0x09: Routing Indicator for Global Title only, GT indicator 0100 meaning GT includes NAI and NPI but no Translation Type or SSN. Byte two is the Translation Type, used by Application Context handlers.
Byte three is the NAI 0x04, meaning international number per ITU-T. Byte four, 0x67, is the NPI for E.164. The BCD digits follow as 11 32 54 86 0F, with 0F as a filler nibble. Decoding gives 11325486 plus filler, a normal incoming international call bound for the Sydney gateway, the kind of trace often seen in ACMA compliance reviews.
Common Pitfalls When Reading Global Titles
Mistaking the Translation Type for a digit is the most common beginner error, because Translation Type sits immediately before the NAI when the relevant GT indicator bit is set. A second pitfall is assuming BCD when the trace was produced by an ASCII-encoded subsystem, which reverses nibble order and yields nonsense digit strings.
Another trap is ignoring the Point Code plus Subsystem Number flag. If SCCP is told to deliver to point code 7-201-1 subsystem 8, no Global Title translation takes place and the digit block in the same address is irrelevant. Operators in regional Western Australia have reported missed calls because a decode script optimised for GT routing skipped the Routing Indicator check.
Practical Tools and Real-World Applications
Engineers who decode SCCP addresses regularly follow a fixed routine: identify the Address Indicator first, decide which route the message wants, then read the digit payload only after the indicator structure is confirmed.
Captures can be processed in Wireshark, with tshark handling bulk traces, or in custom Python scripts. The table below maps the most common routing modes to the Australian traffic patterns they typically resolve.
| Routing Mode | Meaning | Typical NAI Range | Australian Use Case |
|---|---|---|---|
| Route by GT | Translate via STP | 0x03-0x07 | Inbound roamers to Telstra or Optus |
| Route by PC+SSN | Direct delivery | 0x00 | HLR-VLR MAP signalling |
| GT with Translation Type | Routing by application | 0x01-0xFF | SMS service centre queries |
| GT with NAI only | Direct international routing | 0x04 | PSTN gateways in Sydney |
For international traces, validating the decoded digits against both the local operator's register and the ACMA numbering database catches a missed country-code flag before the call reaches the gateway.
Working through ten public SS7 Training lab traces in a single evening and matching each decoded digit string against the reference Python parser is the fastest way to lock in the indicator-byte discipline covered above.
