# OPC and DPC — SS7 Point Codes explained

> Every SS7 node (STP, HLR, MSC, SMSC, SCP) has a unique numeric address called a Point Code (PC). On every SS7 message, the Originating Point Code (OPC) identifies the sender and the Destination Point Code (DPC) identifies the intended recipient — exactly analogous to IP source and destination addresses, but in the SS7 numbering plan. OPC/DPC routing is the foundation of how SS7 traffic moves between network elements.

- Canonical URL: https://www.broadnet.me/answers/ss7-opc-dpc
- Language: en
- Last reviewed: 2026-05-28
- Publisher: BroadNet (https://www.broadnet.me)

## What they actually do

When an MSC sends a MAP-MT-FORWARD-SHORT-MESSAGE to deliver an SMS, it stamps its own Point Code as OPC and the recipient SMSC's Point Code as DPC. STPs (Signalling Transfer Points) examine the DPC and route the message toward the next hop. Inside a single country an operator uses national Point Codes (typically 14-bit ITU or 24-bit ANSI); cross-border SS7 traffic uses International Point Codes (ITU 14-bit, globally coordinated by ITU-T Q.708). A misconfigured OPC or a spoofed OPC is the single most common SS7 misrouting cause.

## Why they matter commercially and for security

Point Codes are a static commercial asset — an operator's IPC is assigned by national regulators (and internationally by ITU), reflects its network position, and is rented through interconnect agreements. From a security standpoint, OPC is also the first signal an SS7 firewall examines: an inbound message claiming to come from an operator's own internal OPC range, but arriving from a foreign peer, is a Category 1 attack under GSMA FS.07 and is dropped on sight. BroadNet's SS7 firewall (/operators/ss7-firewall) maintains an OPC reputation database per peer to catch these spoof attempts.

## Operational angle

Operators publish their IPCs to interconnect partners through GSMA IR.21 documents. Misalignment between IR.21 and live traffic is a chronic operational pain — partners change OPCs without notifying, peers send via stale Point Codes, and traffic dead-letters into STP routing tables. Reconciling IR.21 against live OPC observations is part of what a mature signalling intelligence platform (/platforms/signaling-cdr) automates.

## Privacy and compliance considerations

Point Code data itself is operator-network metadata, not personal data, and is not in PDPL/GDPR scope. But the per-message OPC/DPC pair is part of the SS7 PDU and lives inside CDRs and firewall event logs — which are in scope when correlated with MSISDN. Aggregate OPC-traffic statistics for fraud analysis are fine to share across operators; per-message logs need access control.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [GT — Global Title in SS7 routing explained](https://www.broadnet.me/answers/ss7-global-title)
- [SIGTRAN — SS7 over IP explained](https://www.broadnet.me/answers/what-is-sigtran)
- [SS7 MAP — what it is and why messaging still depends on it](https://www.broadnet.me/answers/ss7-map-explained)
- [GSMA FS.07 and FS.11 — the SS7 signalling firewall standards](https://www.broadnet.me/answers/gsma-fs07-fs11-signaling-firewall)
- [SS7 Firewall](https://www.broadnet.me/operators/ss7-firewall)
- [Signaling & CDR Intelligence](https://www.broadnet.me/platforms/signaling-cdr)