Everything worth knowing, nothing that isn't.
What it actually does
An ATG-equipped firewall fingerprints every inbound SMS along multiple axes: source IP / source SMPP account / source MSISDN reputation, destination MSISDN range concentration, content template clustering (the same templated message arriving at 50,000 numbers in a minute), per-source throughput vs historical baseline, and behavioural signatures (one-way traffic with no inbound, identical inter-arrival gaps consistent with a script). When a combination crosses threshold, the firewall blocks, throttles, or quarantines the traffic and writes an audit record. Modern ATG combines hard rules with ML-driven anomaly scoring.
Why it matters commercially
Without ATG, operators lose A2P revenue to grey routes and SIM-box bypass; senders lose budget to AIT (artificial inflated traffic) pumping. ATG is the technical enforcement layer that makes A2P monetisation work — detect the abusive traffic, block or rate-limit it, offer the legitimate aggregator a direct A2P agreement at the wholesale rate. BroadNet's SMS Firewall (/operators/sms-firewall) ships with ATG modules covering SIM-box detection, AIT-pumping correlation, content-template clustering, and per-source-MSISDN behavioural scoring.
Latency, scale, and compliance angle
ATG decisions are made inline at SMS-firewall scale — single-digit milliseconds added to the message path, hundreds of thousands of TPS sustained. False-positive rates matter enormously: an ATG that blocks 5% of legitimate traffic is worse than no ATG at all because customers lose trust in the network. Mature ATG ships in monitoring-mode first, builds the per-source baseline, then enforces. Compliance: ATG decisions are in scope for FS.11-style monitoring logs, and operators that share blocked-source reputation across the industry typically do so via GSMA T-FCS.
Privacy and compliance considerations
ATG processes MSISDN, source/destination, content templates, and behavioural metadata — all of which becomes personal-data-adjacent the moment it's tied to an individual. Mature ATG deployments minimise the retained content (template hash, not full body), aggressively pseudonymise downstream analytics feeds, and keep the raw decision logs in operator-controlled storage with short retention. Cross-operator threat-sharing is typically done with hashed identifiers, not raw MSISDNs.