Well, Ive been a registered user for over a year now, I guess nows about a good time to share some of my personal knowledge on this site. I know this doesnt really pertain to "security" but it does educate in the network field. so here goes....
Frame Structure
A T1 frame consists of 24 eight bit words plus a framing bit. Each timeslot of the frame contains 8-bits of binary information. Each timeslot is called a Digital Signal Zero (DS0) which is sampled 8000 times per second. This sampling rate was chosen because it can adequately represent voice characteristics of a human speaker when using Pulse Code Modulation (PCM). Therefore, each DS0 contains 64kb/s (8k samples/sec x 8 bits/sample) of user information. Since there are 24 DS0's in a T1 frame, the effective data rate is 1536kbits/sec. Also, each frame contains one framing bit which is used primarily for frame synchronization. This bit adds an additional 8kb/s of overhead to the frame thereby primarily for frame synchronization. This bit adds an additional 8kb/s of overhead to the frame thereby increasing the information rate from 1536kb/s to 1544kb/s. This 1544kb/s is commonly referred to as a Digital Signal One or DS1. Note that the word T1 and DS1 are used interchangeable, however this isnt really accurate. A T1 refers to the digital transmission system which happens t o operate at DS1 rates.
Framing
Framing is used on T1 circuits primarily to synchronize individual T1 frames without the need for external clocking devices. D1 framing was the first framing pattern to be used for transmission of T1 signals. Within a D1 frame, each timeslot contained seven-bits of digitize voice and one-bit used for signaling (call setup and routing). The framing bit identified the boundary between frames. As T1 networks developed other framing and signaling methods needed to be developed. This the superframe (SF) or D4 framing was developed.
A superframe consists of 12 individual T1 frames. The framing bit in every odd frame is used for terminal framing while the framing bit in every even frame is used for signaling framing. Terminal framing and signal framing are used to form a 12-digit word (100011011100). Notice that the even bits used to identify signaling frames are sequenced as X0X0X1X1X1X0. Signaling information is marked by the change in the bit pattern. Frame six transitioned to a one and frame twelve transitioned to a zero. Thereby signaling information is contained within frames six and twelve of a superframe. The sixth and twelfth frames are used the same in D1 framing. Only two of the 12 frames contain signaling information within each timeslot.
Superframe Structure
Today, most T1 facilities use a framing technique called Extended Super Frame (ESF). ESF consists of 24 individual T1 frames. The 24 framing bits are classified into three different catagories: alignment or terminal framing (2kbs), CRC (2kbs), and data link (4kbs). The terminal framing bits are used to identify frame boundaries and positions of other framing-bits. The CRC (cyclic redundancy check) is used to monitor the performance of the ESF. And the data link is used to send performance information as we as other messages.
LineCoding
A T1 signal is transmitted on the link in a binary format (ones and zeros). This binary format is encoded onto the link using a technique known as alternate mark inversion (AMI). The format is alternating pulses (+3/-3 V) denoting a one an no-pulse denoting a zero. The benefit of this encoding is that it has a built-in method of error detection. Whenever consecutive pulses are detected of the same polarity, a bipolar-violation (BPV) is indicated. Therefore, we know that the frame experienced some type of error. A disadvantage to this encoding is the transmission of an all zero's pattern. Since, the T1 is synchronized within the data stream, an absence of pulses (all zero's) can force repeaters and network equipment to lose frame synchronization. In order to maintain proper synchronization, all T1 are required to meet ones density requirements. One of the requirements for ones density is the restriction of transmitting a 15-bit pattern consisting of all zero's. If this pattern is detected the network equipment will correct this by inserting a pulse in the data stream to maintain ones density. In order to maintain ones density within the data world, an encoding method must exist to prevent the insertion of pulses by the network. This could be achieved by simply inverting the data for HDLC framed packets. However this isnt commonly used. More often you find CPE equipment configured to only utilize 7 of the 8 bits of each T1 timeslot. This effectively brings your data rate down from 64K to 56K per channel.
B8ZS (Bipolar 8-Zero Substitution) addresses the zero byte transmission problem. B8Zs intentionally sends bipolar violations to replace strings of eight consecutive zero's. This is done by inserting two intentional BPV's in the T1 signal before it is transmitted. Now, we have created a linecoding method which is suitable for the transmission of data.
CSU/DSU's
In T1 networks, a data service unit (DSU) is used to convert one or more subrate singles into a T1 format. A typical DSU will have a legacy serial interface (RS232, V.35, etc and a T1 interface). The T1 signal that is transmitted is considered to be a 'short haul' signal and is commonly referred to as the Digital Signal Cross Connect - DS1 (DSX1). This DSX interface is capable of driving the T1 signal up to 655 feet. Not all Cisco Routers with built-in CSU's are capable of outputting DSX1 power levels. DSX1 levels are typically used when connecting a Cisco Router directly to a PBX that is also using a DSX1 interface.
A channel service unit (CSU) is required to interface the customer premise equipment to the public T1 carrier facilities. The purpose of the CSU is to provide an electrical interface, lightning/surge protection, signal regeneration, pulse density, and loopback functionality required by the network. The maximum distance between the CSU and the last network repeater should not exceed 3000 feet. Network repeaters are employed every 6000 feet within the T1 carrier network to compensate for signal loss.
Digital Padding
In order to reduce the effects of echo and feedback on a voice call, padding is introduced into the voice-stream. Padding is the introduction of attenuation within the call. Typical attenuation values are 0db (no padding), 3db, or 6db, although other values could be present within the network. Padding cal vary depending on call routing and it is typically a function of distance. It is usually inserted at both end-points of a call but it can occur elsewhere within the network.
There are two different types of padding that can affect the transmitted waveform: analog and digital. Analog padding is accomplished with legacy analog components. These pads preserve the analog waveform relatinoships and are typically found on individual line-cards connected to your phone line (POTS). Analog pads cause no loss in Signal-to-Noise Ration (SNR), however, this is not true for digital pads. Digital pads convert the digital signals (u-law) within the network into a linear form. This linear form is the nattenuated and converted back to u-law. This is the source of the problem with digital padding. Digital pads increase background noise and decrease dynamic range in direct proportion to the value of the pad. This poses a potential problem for 56k server modems. In order to get 56k connection speeds the modems must detect the correct amound of padding being inserted within the network. Therefore, modems will then be able to compensate for the digital padding being inserted. Not all 56k implementations will be able to support 1-7dBs of digital padding. This will hopefully eliminate some of the common padding problems are are seen within X2 and Flex implementations. Most installations will benefit from a 0dB or 3dB padding value in the line-to trunk direction.
Channel Banks
Channel banks are used in most facilities to aggregate DS0 transmissions into higher DS1 transmission rates. This use of channel banks is not advised when trying to implement a dial-in server solutino. This is primarily because of the extra analog-to digital conversion which will prevent the use of 56k modems. Not only will it prevent 56k connections but it will also decrease V.34 speeds because of the diminished signal quality.
DNIS/ANI
Dialed Number Identification Service (DNIS) is the destination address of the called party. This is commonly referred to as the called party number. The opposite of DNIS is Automatic Number Identifier (ANI) or caller id. DNIS information is of particular use with Ciscos modem pooling features. One application of modem pooling could be to guarantee two separate customers a certain type of service. For instance, customer A would dial 555-1212 and customer B would dial 555-3434. When customer A dials into the network access server (NAS) we can assign specific modems with certain configurations to this customer based on DNIS. The same would be true for customer B. Please note that DNIS is not supported with all signaling types nor is it supported with all modem types.
Caller ID (ANI) is typically delivered to most NAS equipment using ISDN. Caller ID can also be transmitted via some other signaling methods ie, E&M and R2.
Clocking
clocking is a very important function in T1 networks. Clocking refers to both timing and synchronization of the T1 carrier. Timing is encoded within the transmitted data signal and is used to ensure synchronization throughout the network. In a typical situation, one side of the T1 provides the master clock whereby the other side is slaved to the master clock. For dial-in installations, you will always be deriving your clock from the service provider. You should always set the clock source to the T1 line and not internally.
When you are connected to multiple T1 providers on the same NAS, it is recommended that you set your T1s to recover clocking from the most accurate source. Clock slips may be expected whenever you are connected to multiple T1 providers
Channel Associated Signaling (CAS) & Common Channel Signaling (CCS)
There are two different types of signaling information within the T1 world. They are CAS and CCS. CAS is the transmission of signaling information within the information band. Various types of CAS signaling are available in the T1 world. The most common forms of CAS signaling are loop-start, ground-start, and E&M. The biggest disadvantage of CAS signaling is the robbing of user information to perform signaling functions. CAS signaling is offten referred to as robbed-bit-signaling because user information is being 'robbed' by the network for other purposes. This form of signaling is not optimal when trying to achieve the highest possible connection rates with modems. Most modems can adjust to the signal quality and still give high speed reliable connections. However the use of 56k modems on CAS lines will drop the connection speeds by almost 2k in the downstream direction per CAS trunk.
CCS is the transmission of signaling information out of the information band. The most notable and widely used form of this signaling type is ISDN. One disadvantage to using an ISDN primary rate interface (PRI) is the removal of one DS0 for signaling use. Therefore, one T1 will have 23 B channels and 1 D channel. It is possible to control multiple PRIs with a single D channel using Non Facility Associated Signaling (NFAS). Therefore, you can configure the other PRIs in the NFAS group to use all 24 DS0s as B channels.
Loopstart Signaling
Loop start signaling is one of the simplest form of CAS signaling. In this form of signaling the CPE equipment will act as the FXS (Foreign Exchange Station) and the telco will act as the FXO (Foreign Exchange Office). A disadvantage of loopstart signaling is the inability to be notified upon a far-end disconnect or answer. For instance, a call is placed from a router configured for fxs-loopstart. When the remote end answers the call, there is no supervisory information sent to the cisco router to relay this information. This is also true when the remote end disconnects the call. Also loopstart provides no incoming call channel seizure. Thereforea situation could arrise where both parties (FXO & FXS) try to simultaneously place calls.
Groundstart Signaling
Groundstart signaling is very similar to loopstart signaling in many regards. The advantage of groundstart signaling over loopstart signaling is the ability for incoming calls to seize the outgoing channel, thereby preventing a situation from occuring. This is done by using the A and B bit on the Network side instead of just the B bit. The A bit is also still used on the CPE side, however the B bit can also be involved depending on the switchs implementation.
E&M Signaling
E&M Signaling is typically used for trunk lines. It has many advantages over the other CAS signaling methods discussed earlier. It provides both disconnect and answer supervision as well as glare avoidances. E&M signaling is simple to understand and is the preferred choice when using CAS. E&M signaling comes in several types. I will only discuss the types supported on Cisco routers. These 3 types supported are wink-start (fgb), wink-start with wink-acknowledge or double-wink (fgd), and immediate start. Wink start is used to notify the remote side it can send the DNIS information. Wink-acknowledgement is a second win that is sent to acknowledge the receipt of the DNIS information. Immediate start does not send any winks at all.
ISDN SIgnaling Q.921
Q.921 is used between the router and Telco switch to provide a full duplex error-free link. Here are the following sequence of events on a PRI in order to initialize layer 2.
----------> SABME
<---------- UA
----------> RRp
<---------- RRf
Either the switch or the router can send the SABME (set asynchronous balanced mode extended) to initialize layer 2. The UA (unnumbered acknowledgement) is sent in response to a SABME. Now, both parties know that they can exchange user messages. The next message that are exchanged, the RRp (receiver ready poll) and the RRf (receiver ready final) are used to verify the link is still up (a keepalive), and also to indicate the frame windowing. The RRf is sent in response to an RRp. In no response is received from a RRp then the sender will try again until it finally gives up and reinitializes layer 2. Typically you will see a DISC message transmitted which is a graceful way to indicate to the remote side that you would like to disconnect layer 2. PRI also uses a terminal endpoint identifier (TEI) of zero. A TEI is used to uniquely identify multiple clients on a ISDN bus. In this case of a PRI, the TEI is statically defined as zero since the link is point-to-point only.
ISDN Signaling Q.931
Q.931 messaging is used to control connections between various nodes on an ISDN network. These messages contain call setup, call clearing, and various status messaging.
This is the typical call flow of an ISDN connection. Left side is the Calling party and the right side is the Called Party
1 Setup ----------> (isdn network)
2 Call Proceeding <---------- (isdn network)
3 (isdn network)----------> Setup
4 (isdn network)<---------- Call Proceeding
5 (isdn network)<---------- Alerting
6 Alerting <---------- (isdn network)
7 (isdn network)<---------- Connect
8 (isdn network)----------> Connect Ack
9 Connect <---------- (isdn network)
10 Connect Ack ----------> (isdn network)
The Setup Message is sent by the calling party to indicate to the network that it is placing a call. The setup message contains some fundamental information elements which indicate the type of service the calling party is requesting. this message will contain at least a bearer capability, channel identifier, and called party number. The bearer capability defines the call type (speech, audio, video, or data). The channel identifier is used to specify the specific interface and channel to provide the requested service. The called party number is the phone number that you would like to connect to. Once the network receives your call setup message, it will process that message and determine if it cal fulfil your requests.
The Call Proceeding message is returned by the local switch to indicate that the call is in the process of being setup. The call is now in progress through the network. The call is received by the called party switch and a SETUP message is sent to the called party. The router will usually respond with a Call Proceeding message followed by an ALERTING message. The alerting message is sent to inform the network that the call has been handed off to the user and the user has been alerted. This is similar to the 'ring' indication you hear when you place a normal telephone call. When the user answers the call, a CONNECT message is sent to inform the network it would like to accept the call. The switch returns a CONNECT ACK back to the user and proceeds to inform the calling-party to have a connect message sent to it. The calling party will receive a connect message from its local switch and proceed to send a connect-ack to inform the switch it has acknowledged the connect message.
