Anatomy of the SS7 Backhaul Behind a Mobile Switching Center
Signaling System No. 7 is the silent backbone of every call, SMS and mobility event on Australian mobile networks. Within a Mobile Switching Center, the SS7 backhaul is the fabric of dedicated links and protocol layers that carries signaling between the MSC, the HLR/VLR, the SMSC and the wider PSTN. Without it, handovers could not complete.
Australia's geography makes the backhaul especially demanding. Switches in Perth routinely exchange signaling with registers in Melbourne over thousands of kilometres of fibre and microwave, with propagation paths that press the protocol timers harder than in denser European markets. Telstra and Optus have long built their cores around high-capacity STPs in Sydney, Melbourne and Brisbane, with transit links fanning out to regional MSCs from Cairns to Kalgoorlie. Weekend spikes driven by football crowds travelling between Melbourne and Sydney only add to the inter-capital load.
The backhaul is structured as Message Transfer Part layers: MTP1 for physical bits over E1, MTP2 for framing and error recovery between adjacent points, and MTP3 for point-code routing. Above this transport pipe, ISUP, SCCP and TCAP carry the call control and database queries that the application layers rely on.
Because each layer introduces its own failure modes and tuning levers, the system must be reasoned about as a whole. A misconfigured MTP2 link set can flood adjacent point codes with retransmissions, and an under-sized STP can turn a localised gateway outage into a statewide event.
MTP2 Link Sets and Physical Transport
The physical foundation is usually an E1 bundle between the MSC and its paired STPs, often carried over protected SDH or MPLS-TP pseudowires to preserve timing and bit-error profile. A link set contains four to sixteen links sized for peak hour load with margin for reroute.
Path diversity is non-negotiable on Australian trunk routes. Carriers split traffic across separate fibres, with duplicated A and B plane hardware at different physical switches so that a single cable cut cannot isolate an MSC.
ISUP and Voice Circuit Management
ISUP rides above MTP3 and carries every call setup message exchanged between MSCs. The IAM, ACM, ANM, REL and RLC messages use the same link set for transport, and each voice circuit maps onto a circuit identification code that points to a timeslot in the underlying E1.
Circuit-group supervision is one of the more practical operational concerns. When a media gateway loses a block of circuits, the Group Blocking and Reset procedures quickly inform the far-end switch. A refresher on the message flows can be found in ISUP circuit supervision, blocking, unblocking and reset messages.
SCCP, TCAP and the Database Layer
SCCP and TCAP carry the database queries that keep mobile subscribers identifiable. A location update from a phone near Bondi triggers a TCAP INSERT to the VLR; an SMS destined for a roaming subscriber triggers an SRI-SM request to the HLR. These transactions reach the right application process through subsystem numbers riding the same backhaul.
SCCP offers more than one transport style, and the choice shapes how traffic behaves:
| Service mode | Behaviour | Australian deployment |
|---|---|---|
| Connectionless (CL) | Each packet routed independently | MAP, SMS, location updates |
| Connection-oriented (CO) | Temporary logical channel | Billing mediation dialogues |
| Subsystem-routed (SSN) | Routes by subsystem number | Internal queries inside an STP complex |
| Global Title Translation | Routes by translated address | Cross-island queries between carriers |
Interconnection between Telstra and Optus requires gateway functionality at the Sydney and Melbourne STPs, and a misaligned GTT entry can silently shift traffic onto a degraded route without raising a clean fault alarm.
Timing, Tuning and Resilience
Australian backhauls inherit the ITU-T timers that govern how MTP2 reacts to faults. T1, T2, T5, T7 and T13 determine how quickly a failure is declared and how far retries travel before raising an alarm.
Common timer tuning targets include:
- Reducing T1 on short, stable metro spans
- Extending T2 over noisy microwave hops
- Balancing T5 retransmission against the T6 recovery window
- Lengthening T7 on remote Pilbara and WA routes
A practical walk-through is provided in the practical guide to SS7 timers T1, T7, T13 and their tuning. The Telecommunications (Interception and Access) Act 1979 and ACMA's critical infrastructure rules also place explicit obligations on backhaul design and documentation.
Security Threats on the Signaling Plane
The protocol richness that makes SS7 useful also makes the backhaul a target. SMS home-routing fraud, subscriber tracking and call interception through malformed Insert Subscriber Data messages have all been observed in practice. Australian carriers respond with firewalls at the STP border that filter MAP messages and screen by source point code.
Frequently observed signalling-plane threats include:
- MAP-level location tracking using spoofed SRI messages
- SMS interception through fraudulent updateLocation requests
- Denial of service via flooded TCAP aborts at a major STP
- Billing fraud through circuit manipulation on international routes
Detection relies on probes attached to a passive split of the E1 link set, replicating the MTP stream to an analytics platform. The discipline of spotting unusual message sequences is sharpened by any study of layered pattern systems, including tangential resources such as side bet mechanics explained.
The Move Toward SIGTRAN and IP Transport
The traditional SS7 backhaul is now increasingly carried over IP rather than TDM. SIGTRAN stacks MTP2 over SCTP and presents an IP-native MTP3 service to the upper layers, allowing carriers to consolidate signaling onto the same MPLS backbone as voice and data. In Australia, the migration is well advanced in capital cities while many regional MSCs still rely on E1 to the nearest aggregation point.
SCTP multihoming replaces the redundancy of duplicated E1 planes but demands careful firewall configuration. M3UA and SUA adaptors must map point codes correctly between IP and TDM domains; a misconfiguration will silently mis-deliver critical TCAP traffic without producing an obvious fault alarm.
What stays constant through the migration is the layered contract between transport, routing and application protocols. Each layer can be tuned, secured and evolved independently, yet the backhaul only behaves well when all three are reasoned about as one interconnected whole. That integrated view, applied to both legacy E1 routes and new IP links, remains the foundation for whatever Australian signaling infrastructure looks like next.
