# SS7 & Signaling Basics - Canonical URL: https://www.broadnet.me/academy/ss7-and-signaling-basics - Language: en - Last updated: 2026-07-18 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. Signalling Advanced The signalling network beneath mobile messaging — SS7, the MAP protocol, SIGTRAN over IP, and the security concerns that shaped modern firewalls. 5 lessons 3 min read Standards-based · self-paced What you'll learn - What SS7 is and why it underpins mobile networks - The protocol stack: MTP, SCCP, TCAP, and MAP - How MAP and SRI-SM deliver an SMS across networks - How SIGTRAN carries SS7 over IP - The security weaknesses that drove signalling firewalls Course outline 1. 01What SS7 is 2. 02The protocol stack 3. 03MAP and SMS delivery 4. 04SIGTRAN — SS7 over IP 5. 05SS7 security concerns 6. ★Key takeaways [All courses](https://www.broadnet.me/academy) Lesson 01 ## What SS7 is SS7 — Signalling System No. 7 — is the out-of-band signalling network that mobile and fixed operators use to set up calls, deliver SMS, and support roaming. "Out-of-band" means signalling travels on a separate control channel from the voice or message payload. SS7 was designed in an era when only a small, trusted group of national carriers could reach the network. That trust assumption — every peer is legitimate — is the root of many security problems that surfaced once the network became globally interconnected. Despite being decades old, SS7 still carries core interworking functions. Understanding it is prerequisite to understanding SMS delivery, roaming, and the firewalls built to defend the signalling layer. Lesson 02 ## The protocol stack SS7 is layered. MTP (Message Transfer Part) provides the lower transport layers. SCCP (Signalling Connection Control Part) adds global-title addressing and routing, so a message can be addressed to a logical network element rather than a fixed point code. TCAP (Transaction Capabilities Application Part) carries transactional dialogues on top of SCCP, and MAP (Mobile Application Part) is the application protocol that expresses mobile-specific operations — locating subscribers, authenticating them, and routing SMS. Two addressing concepts recur: point codes (OPC / DPC — originating and destination point codes) identify nodes at the network level, while global titles (typically an E.164-style address) let SCCP route to elements like an HLR without knowing their point code. Lesson 03 ## MAP and SMS delivery SMS delivery leans on a small set of MAP operations. To terminate a message, the sending SMSC issues SRI-SM (Send Routing Info for Short Message) toward the recipient's HLR (Home Location Register) to discover which serving node the subscriber is currently attached to. The HLR returns the address of the serving MSC/VLR, and the SMSC delivers the message there with MT-ForwardSM. If the subscriber is unreachable, the network sets a flag and notifies the SMSC when the handset becomes available again. This flow is exactly what home-routing and signalling firewalls manipulate: by intercepting SRI-SM, an operator can force terminating traffic through a controlled checkpoint, which is the mechanism behind MT-bypass protection. Lesson 04 ## SIGTRAN — SS7 over IP Modern networks rarely run SS7 over legacy TDM links end to end. SIGTRAN is the family of protocols that transports SS7 signalling over IP, using SCTP (Stream Control Transmission Protocol) as a reliable transport with adaptation layers such as M3UA to carry MTP-level traffic. SIGTRAN preserves the SS7 application protocols — MAP and TCAP are unchanged — while modernising the transport beneath them. This is what lets an operator interconnect signalling over IP networks rather than dedicated links. For a messaging platform, SIGTRAN is the layer at which many direct operator interconnects are actually implemented today, so signalling security is an IP-network concern as much as a telecom one. Lesson 05 ## SS7 security concerns Because SS7 assumes every peer is trusted, an attacker with signalling access can abuse legitimate operations. SRI-SM can be used to probe a subscriber's location or existence; other MAP messages can be misused to intercept SMS (including OTPs) or track movement. The industry response is signalling firewalls that apply category-based filtering — as described in GSMA FS.11 — distinguishing messages that should only ever come from inside the home network, only from a roaming partner, or legitimately from anywhere. Messages arriving from the wrong direction are blocked. Diameter, the signalling protocol for LTE/4G and beyond, inherits similar concerns and has its own security guidance (GSMA FS.19). The lesson is durable: signalling networks need explicit filtering because their original trust model no longer holds. Key takeaways - SS7 is the out-of-band signalling network for calls, SMS, and roaming, built on an obsolete all-peers-trusted model. - The stack layers MTP, SCCP, TCAP, and MAP; nodes are addressed by point codes and global titles. - SMS termination uses SRI-SM to locate a subscriber via the HLR, then MT-ForwardSM to deliver. - SIGTRAN carries SS7 over IP; signalling firewalls apply GSMA FS.11 category filtering to block abuse. Keep going ### Related answers, products & tools - [SS7 MAP explained](https://www.broadnet.me/answers/ss7-map-explained) - [What is SIGTRAN?](https://www.broadnet.me/answers/what-is-sigtran) - [SS7 OPC / DPC](https://www.broadnet.me/answers/ss7-opc-dpc) - [SS7 global title](https://www.broadnet.me/answers/ss7-global-title) - [Diameter S6a explained](https://www.broadnet.me/answers/diameter-s6a-explained) - [SS7 Firewall (operators)](https://www.broadnet.me/operators/ss7-firewall) References - [GSMA · FS.11 SS7 interconnect security monitoring](https://www.gsma.com/solutions-and-impact/technologies/security/) - [3GPP TS 29.002 — Mobile Application Part (MAP)](https://www.3gpp.org/dynareport/29002.htm) Up next in the curriculum [Intermediate · Protocols SIP & Voice for Messaging Teams The signalling protocol behind programmable voice — SIP basics and methods, SDP/RTP/SRTP media, a call flow end to end, SIP trunking and the SBC, and where VoLTE fits.](https://www.broadnet.me/academy/sip-and-voice-for-messaging-teams) [Intermediate · Channels RCS & Rich Messaging Rich business messaging beyond SMS — the RCS Universal Profile and MaaP, rich cards and interactive messaging, verified senders, WhatsApp Business, and channel fallback and orchestration.](https://www.broadnet.me/academy/rcs-and-rich-messaging) Put it into practice ## Build with what you just learned. Talk to a real engineer about your use case, or open the developer docs and send a message across the routes this course describes. [Talk to engineering](https://www.broadnet.me/contact) [Developer docs](https://www.broadnet.me/developers) Why learn from BroadNet - Since 2003 - Countries 200+ - Operator links 1,000+